CVE-2026-55235: 
Python vulnerability analysis and mitigation

CVE-2026-55235 is an improper authentication vulnerability in langgraph-api (the LangGraph Server runtime) that allows a low-privileged attacker to reach internal server routes without authentication by specifying a relative webhook target. When the server delivers such a webhook, it routes the request through an in-process loopback transport that the authentication middleware treats as internal and skips authentication checks. All versions of langgraph-api prior to 0.10.0 are affected, including deployments via the LangGraph Platform Helm chart. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, LangChain Helm Advisory).

The root cause is improper authentication (CWE-287): the authentication middleware in langgraph-api distinguishes between external and internal (loopback) requests, and skips authentication for the latter. An attacker with low privileges can create a run or cron job specifying a relative URL as the webhook target. When the server later delivers the webhook callback, it routes the HTTP request back into the same application process via an in-process loopback transport, bypassing the authentication middleware entirely. This allows the attacker's request to interact with thread and run management routes as if it were an authenticated internal call, enabling cross-user operations in multi-tenant deployments (GitHub Advisory, LangChain Helm Advisory).

In multi-tenant deployments that scope threads and runs by owner, a low-privileged attacker can create runs on or modify the state of threads belonging to other users — actions that would be correctly denied if attempted via direct external requests. There is also a limited confidentiality impact: metadata from the targeted thread may be incorporated into the created run record, exposing some information about another user's thread. Availability impact is rated low, as the unauthorized creation of runs could disrupt the normal operation of targeted threads (GitHub Advisory).

No evidence of in-the-wild exploitation has been reported by the vendor or researchers. The vulnerability requires the attacker to have low-level privileges (ability to create runs or crons with webhook targets) and the deployment must rely on per-user authorization to separate threads and runs. No public proof-of-concept exploit code has been identified. The CVE status was listed as Reserved at time of Feedly ingestion, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, GitLab Advisory).

1. Identify a vulnerable deployment: Confirm the target is running langgraph-api < 0.10.0 in a multi-tenant configuration where per-user authorization separates threads and runs, and where users are permitted to specify webhook targets when creating runs or crons.
2. Obtain low-privileged access: Authenticate to the LangGraph Server with a valid but low-privileged user account that has permission to create runs or cron jobs.
3. Identify a target thread: Enumerate or infer the thread ID of a thread owned by another user (e.g., via limited metadata leakage or knowledge of the application's thread ID scheme).
4. Create a run or cron with a relative webhook target: Submit a request to create a run or cron job, specifying a relative URL (e.g., /threads/<victim-thread-id>/runs) as the webhook target, pointing to an internal route that operates on the victim's thread.
5. Trigger webhook delivery: Wait for or trigger the server to deliver the webhook. The server routes the callback through the in-process loopback transport, bypassing authentication middleware.
6. Achieve unauthorized action: The loopback request reaches the internal route without authentication context, allowing creation of a run on or modification of the state of the victim's thread, and potentially exposing limited thread metadata (GitHub Advisory, LangChain Helm Advisory).

• Logs: Server access logs showing internal/loopback HTTP requests to thread or run management routes (e.g., /threads/<id>/runs) that are not associated with a corresponding authenticated external request; requests originating from 127.0.0.1 or localhost to sensitive API routes.
• Application Behavior: Unexpected runs appearing on threads owned by users who did not initiate them; run records containing metadata from threads belonging to a different user than the run creator.
• Network: Webhook delivery events targeting relative or loopback URLs (e.g., http://localhost/... or relative paths) in run or cron job configurations, visible in application audit logs or database records.

Upgrade langgraph-api to version 0.10.0 or later, which introduces a webhook URL policy that denies loopback delivery by default (webhooks.url.disable_loopback defaults to enabled). This blocks relative webhook targets routed through the in-process transport, as well as localhost-style hostnames, loopback address ranges, and hostnames resolving to the loopback range. If loopback webhook delivery is legitimately required, it can be re-enabled by setting webhooks.url.disable_loopback: false in langgraph.json or via the LANGGRAPH_WEBHOOKS environment variable — but only when the operator controls the targeted routes and applies authorization within them (GitHub Advisory, LangChain Helm Advisory).

The advisory was originally published by nick-hollon-lc to the langchain-ai/helm repository on June 11, 2026, and subsequently published to the GitHub Advisory Database on August 19, 2026. The reporter credited is BedheadProgrammer. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).