CVE-2026-55236: 
Python vulnerability analysis and mitigation

CVE-2026-55236 is an improper authorization vulnerability in langgraph-api (the LangGraph Server runtime) that allows authenticated users to access private assistants owned by other users during run creation. The flaw affects all langgraph-api versions prior to 0.10.0 and was first published on June 11, 2026, with the advisory updated on August 19, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, LangChain Helm Advisory).

The root cause is an inconsistent authorization event dispatch (CWE-285: Improper Authorization) in the run-creation code path. While direct assistant reads and cron creation correctly dispatch the assistants.read authorization event, run creation instead dispatched assistants.search with an incomplete value. In deployments where custom authorization handlers only register an assistants.read handler — without an assistants.search handler or a global fallback — no handler was invoked during run creation, the returned filter set was empty, and the owner constraint was omitted from the database query. This allowed an authenticated, low-privileged attacker to reference a private assistant owned by another user in a run-creation request, bypassing the access controls that correctly blocked direct reads, searches, and cron creation against that assistant (GitHub Advisory).

Successful exploitation exposes another user's private assistant metadata, config, and context fields through the run-creation response — fields that can contain sensitive configuration data and are encrypted at rest precisely because of their sensitivity. Additionally, an attacker can create a run that executes using another user's private assistant configuration, violating integrity boundaries beyond their authorization scope. Availability is not impacted, and the vulnerability is scoped to deployments using specific custom authorization handler configurations (GitHub Advisory, LangChain Helm Advisory).

No public proof-of-concept exploit code has been published, and the vendor states there is no evidence of this vulnerability being exploited in the wild. Exploitation requires low privileges (an authenticated account on the platform) and high attack complexity, as the attacker must know or enumerate a target assistant's identifier and the deployment must use the specific vulnerable custom authorization handler configuration. The CVE status is currently "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify a vulnerable deployment: Confirm the target LangGraph Server deployment runs langgraph-api < 0.10.0 and uses custom authorization handlers that register only an assistants.read handler (without an assistants.search handler or global fallback).
2. Authenticate: Obtain valid low-privileged credentials for the LangGraph Server instance.
3. Enumerate assistant IDs: Attempt to discover or guess the assistant ID of a private assistant owned by another user (e.g., through prior knowledge, API enumeration, or leaked identifiers).
4. Craft a run-creation request: Submit a run-creation API request referencing the target private assistant's ID. Because the assistants.search event is dispatched with an incomplete value and no handler is registered for it, the owner constraint is omitted from the query.
5. Extract sensitive data: Parse the run-creation response, which merges the referenced assistant's metadata, config, and context fields — potentially containing sensitive configuration — into the response returned to the attacker (GitHub Advisory).

• Logs: Run-creation API requests (e.g., POST /runs) referencing assistant IDs not owned by the requesting user; absence of assistants.search handler invocation logs during run creation in deployments with custom authorization handlers.
• Application Behavior: Run-creation responses containing metadata, config, or context fields populated from assistants not belonging to the requesting user.
• Audit Trail: Runs appearing in the system associated with private assistants of users other than the run creator, particularly in multi-tenant deployments (GitHub Advisory).

Upgrade langgraph-api to version 0.10.0 or later, which fixes the issue by dispatching the assistants.read authorization event consistently across run creation, cron creation, and direct assistant reads in both in-memory and gRPC/Postgres runtimes. As a workaround prior to upgrading, register an assistants.search handler (or a global handler covering all assistant events) that applies the same owner filter as the assistants.read handler. Operators should also audit their custom authorization handlers to ensure consistent owner filtering across all assistant-related event types. Note that the fix introduces a behavioral change: the metadata field on the assistants.read event during run and cron creation is no longer populated, so handlers relying on it should migrate that logic to run/cron create handlers (GitHub Advisory, LangChain Helm Advisory).

The advisory was originally published by nick-hollon-lc to the langchain-ai/helm repository on June 11, 2026, and credited reporter OneThing4101 for discovery. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).