CVE-2026-115885mediumCWE-532

CVE-2026-115885: medium-severity vulnerability in langchain-ai langgraph

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Published · Updated

Follow this CVE+ Monitor langgraph+ Monitor langgraph-cli

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.1epss 0.1%
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
langchain-ai · langgraph
Related CVEs — langchain-ai langgraph

In the same product, most dangerous first.

CVE-2026-28277MEDIUMLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loadingEPSS 5.5%CVE-2025-67644HIGHLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodEPSS 2.3%CVE-2025-64439HIGHLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializerEPSS 0.9%CVE-2026-118667MEDIUMLangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsEPSS 0.4%CVE-2026-71433MEDIUMLangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite storesEPSS 0.4%CVE-2026-115883MEDIUMLangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesEPSS 0.3%