CVE-2026-48776

Name of the Vulnerable Software and Affected Versions LangGraph Python SDK versions prior to 0.3.15

Description Unsafe URL path construction occurs due to unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Identifiers containing characters with special meaning in URL paths can cause requests to address different resources or resource types than intended. In environments where identifier values originate from untrusted sources, this may lead to unauthorized access, modification, or deletion of resources. This is particularly critical in deployments that forward end-user values directly into SDK identifier parameters without validation (such as UUID checks) and rely on URL-prefix-based authorization at an upstream layer, such as a reverse proxy, edge gateway, or Web Application Firewall (WAF), where authorization is based on the intended path rather than the final delivered request path.

Recommendations Update to version 0.3.15.