Detections
Analytics

SCA: security update for langgraph-sdk (GHSA-w39p-vh2g-g8g5)

critical Tenable Cloud Security Plugin ID 443931

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and
 stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through
 unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without
 sanitization of those values, identifiers that contain characters with special meaning in URL paths could
 cause the resulting request to address a different resource (and potentially a different resource type)
 than the SDK method's call site indicates. In deployments where the SDK receives identifier values that
 originate from untrusted sources, this could result in unintended access, modification, or deletion of
 resources beyond the calling user's authorization scope. This issue is most consequential in deployments
 that forward end-user-supplied values directly into SDK identifier parameters without first validating
 them against an expected format (such as a UUID), and rely on URL-prefix-based authorization at an
 upstream layer (reverse proxy, edge gateway, WAF), where the authorization decision is made on the SDK
 call's intended path rather than on the final delivered request path. The issue has been fixed in version
 0.3.15. (CVE-2026-48776)

Solution

Update the langgraph-sdk library and its related packages to version 0.3.15 or later.

See Also

https://github.com/advisories/GHSA-w39p-vh2g-g8g5

Plugin Details

Severity: Critical

ID: 443931

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 6/25/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.77

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-48776

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/16/2026

Reference Information

CVE: CVE-2026-48776