CVE-2026-118667Published
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118667 · Microsoft / collected KEV context
cve-program · CVE-2026-118667
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-3fx2-cqw9-xr3c
- https://github.com/langchain-ai/langgraph/pull/9213
- https://github.com/langchain-ai/langgraph/commit/d89c7e100ec6fc1512544d23b0a7c5169699ef3e
- https://github.com/langchain-ai/langgraph/releases/tag/1.2.14
- https://github.com/langchain-ai/langgraph/releases/tag/sdk%3D%3D0.4.6
Related operational evidence
Explicit CVE identifiers- LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests · Newly collected advisory · 28 Oct 2026