CERT24CVE-2026-118667 — Unencoded LangGraph SDK v3 identifiers can redirect authenticated GET requestsLoading data…
CERT24Threat Observatory
Period

CVE-2026-118667 — Unencoded LangGraph SDK v3 identifiers can redirect authenticated GET requests

The LangGraph Python SDK v3 streaming client inserts caller-supplied thread_id and assistant_id values into request paths without encoding them. Relative path segments can redirect an authenticated GET request to another path on the same configured server.

← Back to intelligence

CVE-2026-118667 — Unencoded LangGraph SDK v3 identifiers can redirect authenticated GET requests

The LangGraph Python SDK v3 streaming client inserts caller-supplied thread_id and assistant_id values into request paths without encoding them. Relative path segments can redirect an authenticated GET request to another path on the same configured server.