CVE-2026-118668

LangGraph drops JavaScript authorization namespace changes

LangChain · langgraph-api JavaScript/TypeScript custom authentication

First documented disclosure · Review checkpoint

Summary

An authenticated user can reach another user's stored agent data when isolation relies on namespace rewriting.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: Coinspect reproduced cross-user access with synthetic records and verified the fix across Store operations. Reviewed sources do not establish malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The JavaScript authorization handler returns a changed namespace, but the runtime bridge drops that change before executing the Store operation.

Conditions required

Affected langgraph-api, JavaScript or TypeScript custom auth, multiple users and rewrite-based Store isolation. Python auth and handlers that reject unauthorized namespaces are unaffected.

Potential impact

Cross-user reads, searches, overwrites and deletions of Store data.

Affected versions and configurations

>=0.1.2 and <0.15.0.

Fix and mitigation status

0.15.0 applies authorization changes across the runtime boundary and validates the resulting namespace.

Practical next steps

Upgrade to a supported patched release. Pending upgrade, reject unauthorized namespaces on every Store action instead of relying on rewriting; test two-user isolation at the actual Store operation.

Operating lesson

An authorization decision protects data only if its transformed parameters reach the operation.

Evidence and limits

The public GHSA is September 28; the package shipped September 25 and CNA followed October 28. Although today's changelog labels the fix under September 24, the exact wording first appears in the September 28 public documentation commit, so it is not used to backdate disclosure. Coinspect's October 28 report describes synthetic-data testing and October 1 fix verification, not customer breaches.

Sources