CVE-2026-55235: LangGraph API Authentication Bypass Vulnerability

CVE-2026-55235 Overview

CVE-2026-55235 is an authentication bypass vulnerability [CWE-287] in langgraph-api, the component that implements the LangGraph API for rapid development and testing of LangChain agents. Versions prior to 0.10.0 allow a run or cron to specify a relative webhook target delivered through an in-process loopback transport. The authentication middleware treats loopback delivery as internal and skips the authentication context applied to external requests. In deployments that rely on per-user authorization to isolate threads and runs, an authenticated user can direct a webhook at the server's own thread and run routes to act against another user's data.

Critical Impact
An authenticated user can create runs on or modify another user's threads and incorporate limited target-thread metadata into new run records, breaking per-user authorization boundaries.

Affected Products

langgraph-api versions prior to 0.10.0
LangGraph deployments that rely on per-user authorization to separate threads and runs
LangGraph deployments that deliberately re-enable loopback webhook delivery

Discovery Timeline

2026-09-14 - CVE-2026-55235 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-55235

Vulnerability Analysis

The flaw sits at the intersection of webhook delivery and authentication middleware. langgraph-api supports webhook targets attached to runs and crons. When a target is specified as a relative path, the API delivers it through an in-process loopback transport rather than issuing an external HTTP request. The authentication middleware inspects the transport and classifies loopback-delivered requests as internal, bypassing the authentication context that would normally be enforced for a caller reaching the same route over the network.

An authenticated tenant can register a webhook whose relative path targets the server's own thread and run endpoints. When the loopback request is dispatched, it executes without the requester's user identity or authorization scope. The handler therefore operates against threads and runs owned by other users. The result is limited write access on other tenants' threads and the ability to fold portions of a target thread's metadata into a newly created run record.

Root Cause

The root cause is a trust boundary error in the authentication middleware. The middleware conflates transport type with trust level, assuming any request arriving over the in-process loopback originated from a trusted internal component. Because webhook targets are user-controlled, this assumption is invalid. Loopback delivery becomes an unauthenticated re-entry point into authenticated routes.

Attack Vector

Exploitation requires an authenticated account on a multi-tenant LangGraph deployment that enforces per-user authorization on threads and runs. The attacker creates a run or cron and sets the webhook target to a relative URL pointing at internal thread or run routes. When the platform delivers the webhook, the loopback transport bypasses authentication, and the request executes with internal trust. The attacker can then create runs against victim threads or influence run records with victim thread metadata. See the GitHub Security Advisory GHSA-2c9q-c2q9-qgqv for the vendor's technical description.

Detection Methods for CVE-2026-55235

Indicators of Compromise

Run or cron records whose webhook field contains a relative path targeting internal API routes such as /threads, /runs, or nested resource paths
Server access logs showing loopback-originated requests to thread or run endpoints without an associated authenticated user identifier
Run records that reference thread identifiers not owned by the run's creator
Unexpected new runs appearing on threads belonging to other tenants shortly after another user submitted a run with a webhook

Detection Strategies

Audit the webhook targets stored on all existing runs and crons and flag any entry that is a relative path rather than an absolute external URL
Correlate run creation events with the requesting user identity and the owning user of the referenced thread; mismatches indicate potential exploitation
Instrument the authentication middleware to log when a request is classified as internal via loopback, and alert on any such request hitting thread or run routes

Monitoring Recommendations

Forward langgraph-api application logs and run metadata to a centralized log platform and retain them long enough to reconstruct cross-tenant activity
Alert on webhook configurations that resolve to same-origin routes or contain path traversal patterns
Track baseline rates of run creation per user and alert on spikes that coincide with webhook-triggered internal requests

How to Mitigate CVE-2026-55235

Immediate Actions Required

Upgrade langgraph-api to version 0.10.0 or later, which removes the authentication bypass on loopback-delivered webhooks
Inventory existing runs and crons and remove any webhook target that uses a relative path or points at the API's own routes
Rotate any credentials or tokens that may have been exposed to cross-tenant reads via manipulated run records

Patch Information

The issue is fixed in langgraph-api version 0.10.0. Refer to the LangChain AI agent server changelog for release notes and the GitHub Security Advisory GHSA-2c9q-c2q9-qgqv for advisory details.

Workarounds

Reject webhook targets that are not absolute URLs pointing at an external host, enforced at the API gateway or a reverse proxy in front of langgraph-api
If loopback delivery must remain enabled, restrict it to a controlled allow-list of same-process routes that are safe to invoke without authentication
Deny egress from the langgraph-api process to its own listening socket at the network layer where feasible

bash

# Example: block relative webhook paths at an NGINX reverse proxy fronting langgraph-api
# Reject POST/PUT to run and cron endpoints whose JSON body contains a relative webhook
location ~ ^/(runs|threads|crons) {
    if ($request_body ~* "\"webhook\"\s*:\s*\"/") {
        return 400 "relative webhook targets are not permitted";
    }
    proxy_pass http://langgraph_upstream;
}