rewindex

RewindexCVEsLangChain (LangSmith)

CVE-2026-55235: langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Medium · CVSS 5.9 (CVSS 3.1)EPSS 0.37%, 30th percentilePublished Updated Assigner: GitHub_M

Description

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal without applying the authentication context used for external requests. In deployments that rely on per-user authorization to separate threads and runs, an authenticated user can direct a webhook to the server's own thread and run routes, allowing creation of a run on or modification of another user's thread and limited incorporation of the targeted thread's metadata into the created run record. The affected path requires webhook targets and per-user authorization boundaries; deployments that deliberately re-enable loopback delivery should restrict it to controlled same-process routes because those webhooks remain unauthenticated. This issue is fixed in version 0.10.0.

Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L · CWE-287

Tracked companies

LangChain (LangSmith)

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

langchain-ai: langgraph-api

References

All CVEsMarkdownJSON