CVE-2026-55236: LangGraph API Privilege Escalation Flaw

CVE-2026-55236 Overview

CVE-2026-55236 is an improper authorization vulnerability [CWE-285] in langgraph-api, the component that implements the LangGraph API for rapid development and testing. Versions prior to 0.10.0 dispatch the wrong authorization event when creating a run, allowing a low-privileged user to reference another user's private assistant. The run-creation response can disclose the private assistant's metadata, configuration, and context. The referenced assistant's configuration can then execute inside the attacker's run. Only deployments that register custom resource handlers for assistants.read without an equivalent assistants.search handler or global fallback are affected.

Critical Impact
Low-privileged authenticated users can read and execute other tenants' private LangGraph assistants through POST /runs or POST /threads/{thread_id}/runs, breaking multi-tenant isolation.

Affected Products

langgraph-api versions prior to 0.10.0
LangGraph deployments using custom authorization handlers that register only assistants.read
LangGraph deployments without a global fallback authorization handler

Discovery Timeline

2026-09-14 - CVE-2026-55236 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55236

Vulnerability Analysis

The vulnerability resides in the run-creation code path of langgraph-api. When a client submits POST /runs or POST /threads/{thread_id}/runs, the service must verify that the caller owns or can access the assistant referenced by the request. Direct assistant reads and cron creation dispatch the assistants.read authorization event, which custom handlers use to inject an owner filter.

The run-creation path instead dispatches assistants.search with an incomplete value. In deployments that register a custom assistants.read handler but no assistants.search handler and no global fallback, the search event has no applicable handler. No owner filter is applied, and the lookup returns assistants owned by other users.

The response then discloses the assistant's metadata, config, and context. The run continues to execute using the victim assistant's configuration, potentially invoking tools and models that the attacker should not reach.

Root Cause

The root cause is inconsistent authorization event dispatch across API paths. The run-creation path uses assistants.search where sibling paths use assistants.read, and deployments that only handle the documented assistants.read event silently skip authorization. This is a classic missing authorization check [CWE-285] where the security control depends on external handler registration.

Attack Vector

An authenticated low-privileged user submits a run creation request referencing another tenant's private assistant identifier. The server dispatches assistants.search with an incomplete value. Because no handler owns that event, the assistant is returned without an owner filter, and the run creation succeeds. The attacker receives the private assistant's configuration in the response and can execute runs under that configuration.

No user interaction is required beyond the API call. The attack requires valid low-privilege credentials and knowledge or enumeration of a target assistant identifier. Deployments applying an owner filter through a global handler or across all assistant events are not affected.

Detection Methods for CVE-2026-55236

Indicators of Compromise

Run creation requests to POST /runs or POST /threads/{thread_id}/runs where the referenced assistant_id does not belong to the authenticated user.
API responses to run creation containing assistant metadata, config, or context fields not owned by the requesting principal.
Runs executing with assistant configurations that reference tools, models, or credentials scoped to a different tenant.

Detection Strategies

Audit langgraph-api access logs and correlate assistant_id values in run-creation calls against the assistant owner recorded in the datastore.
Compare authorization events emitted by the service; alert when assistants.search fires without a corresponding registered handler.
Baseline per-user assistant reference patterns and flag anomalous cross-tenant references.

Monitoring Recommendations

Enable verbose authorization logging in langgraph-api to record handler dispatch decisions for every run creation.
Forward LangGraph API and authorization logs to a centralized analytics platform for cross-tenant access analysis.
Monitor for unexpected outbound tool invocations or model calls that originate from runs created by users who should not have access to the underlying assistant.

How to Mitigate CVE-2026-55236

Immediate Actions Required

Upgrade langgraph-api to version 0.10.0 or later, which corrects the dispatched authorization event on the run-creation path.
Inventory custom authorization handlers and confirm coverage for both assistants.read and assistants.search events.
Review recent run-creation activity for cross-tenant assistant_id references and rotate any credentials embedded in exposed assistant configurations.

Patch Information

The issue is fixed in langgraph-api version 0.10.0. Refer to the GitHub Security Advisory GHSA-jfj5-wrj9-63x4 and the GitHub LangChain Changelog for release details.

Workarounds

Register a global fallback authorization handler that applies an owner filter to any unhandled resource event, including assistants.search.
Add an explicit assistants.search handler that mirrors the owner-scoping logic used by the existing assistants.read handler.
Restrict network access to the LangGraph API to trusted principals until the upgrade is deployed.

bash

# Upgrade langgraph-api to the fixed release
pip install --upgrade "langgraph-api>=0.10.0"

# Verify installed version
pip show langgraph-api | grep -i version