CVE-2026-115885mediumCWE-532

CVE-2026-115885: fallo de gravedad media en langchain-ai langgraph

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear langgraph+ Monitorear langgraph-cli

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.1epss 0.1%
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
langchain-ai · langgraph
CVEs relacionadas — langchain-ai langgraph

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-28277MEDIUMLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loadingEPSS 5.5%CVE-2025-67644HIGHLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodEPSS 2.3%CVE-2025-64439HIGHLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializerEPSS 0.9%CVE-2026-118667MEDIUMLangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsEPSS 0.4%CVE-2026-71433MEDIUMLangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite storesEPSS 0.4%CVE-2026-115883MEDIUMLangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesEPSS 0.3%