CVE-2026-48776: LangGraph Python SDK Path Traversal Flaw

CVE-2026-48776 Overview

CVE-2026-48776 affects the LangGraph Python SDK, a client library used to connect to running LangGraph API servers and manage assistants, threads, and streaming runs. Versions 0.3.14 and prior construct HTTP request paths from unsanitized caller-supplied identifier values. Identifiers containing characters with special meaning in URL paths can redirect requests to a different resource, or a different resource type, than the SDK call site intends. The issue is tracked under [CWE-22] (Path Traversal) and has been resolved in version 0.3.15.

Critical Impact
Untrusted identifier values forwarded into SDK parameters may bypass URL-prefix-based authorization enforced at upstream proxies, gateways, or WAFs, leading to unintended access, modification, or deletion of resources outside the caller's authorization scope.

Affected Products

LangGraph Python SDK versions 0.3.14 and prior
Deployments forwarding end-user-supplied values directly into SDK identifier parameters
Architectures relying on URL-prefix-based authorization at reverse proxies, edge gateways, or WAFs

Discovery Timeline

2026-06-17 - CVE-2026-48776 published to NVD
2026-06-17 - Last updated in NVD database
Fix released - LangGraph SDK version 0.3.15 published on GitHub

Technical Details for CVE-2026-48776

Vulnerability Analysis

The LangGraph Python SDK builds HTTP request paths by interpolating caller-supplied identifiers, such as assistant IDs or thread IDs, directly into URL templates for resource operations. When the SDK receives an identifier value, it does not validate that the value matches an expected format such as a UUID. An attacker controlling the identifier input can embed characters like /, .., or ? to alter the final request path.

The resulting HTTP request reaches a different endpoint than the SDK method advertised. A call intended to read one resource may instead address a different resource, or even a different resource type, on the upstream LangGraph API server. This makes the vulnerability most impactful when applications forward unvalidated end-user input into SDK methods.

Root Cause

The root cause is missing input sanitization on identifier parameters used in HTTP path construction. The SDK trusts caller-supplied strings as opaque identifiers and inserts them into URL templates without URL-encoding reserved characters or enforcing a strict format. This violates the principle that path components must be validated against an expected grammar before being assembled into a request URL.

Attack Vector

Exploitation requires an attacker to influence the value passed into an SDK identifier parameter, typically through an application that forwards user input into LangGraph SDK calls. The attack succeeds when authorization decisions are made upstream based on the SDK's nominal request path rather than the final delivered path. By injecting path separators or traversal sequences into the identifier, the attacker causes the SDK to issue a request that the upstream authorization layer evaluated against a different, permitted path. The vulnerability requires high attack complexity and low-privileged authenticated access, and produces low confidentiality and integrity impact per the CVSS vector.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-w39p-vh2g-g8g5. No verified proof-of-concept code is published.

Detection Methods for CVE-2026-48776

Indicators of Compromise

HTTP requests from LangGraph SDK clients containing URL-encoded path separators (%2F, %2E%2E) or raw .. sequences inside identifier path segments.
API server access logs showing resource paths that do not match the SDK method's documented URL template.
Discrepancies between the request path observed at the upstream proxy and the path delivered to the LangGraph API server.
Unexpected resource access patterns by low-privileged authenticated users targeting resource IDs outside their normal scope.

Detection Strategies

Inspect outbound requests issued by applications using langgraph-sdk and verify identifier path segments conform to UUID or expected formats.
Enable verbose logging at the LangGraph API server to record the final delivered path and compare against the upstream authorization decision path.
Audit application code paths that pass user-controlled values into SDK methods such as assistant, thread, and run identifier parameters.

Monitoring Recommendations

Alert on any LangGraph API request whose path segment for an identifier contains characters other than [A-Za-z0-9-].
Correlate authorization decisions made at the edge with the actual resource served by the LangGraph API server to detect path mismatches.
Track installed versions of langgraph-sdk across development and production environments to identify unpatched clients.

How to Mitigate CVE-2026-48776

Immediate Actions Required

Upgrade langgraph-sdk to version 0.3.15 or later in all Python applications that consume the LangGraph API.
Inventory every call site that passes externally sourced values into SDK identifier parameters and add format validation upstream.
Reconfigure authorization to evaluate the final delivered request path at the LangGraph API server rather than relying solely on URL-prefix decisions at the edge.

Patch Information

The maintainers fixed the unsafe URL path construction in LangGraph SDK release 0.3.15. The release sanitizes identifier values before they are interpolated into HTTP request paths. Refer to the GitHub Security Advisory GHSA-w39p-vh2g-g8g5 for the full advisory text.

Workarounds

Validate all identifier values against a strict format such as UUIDv4 before passing them into SDK methods.
Reject identifier inputs containing /, \, ?, #, ., or percent-encoded equivalents at the application boundary.
Move authorization checks from URL-prefix matching at the proxy to per-resource checks evaluated by the LangGraph API server itself.
Restrict the privileges of service accounts used by SDK clients to the minimum required resource scope.

bash

# Upgrade the LangGraph Python SDK to the fixed release
pip install --upgrade "langgraph-sdk>=0.3.15"

# Verify the installed version
python -c "import langgraph_sdk, importlib.metadata; print(importlib.metadata.version('langgraph-sdk'))"