Detections
Analytics

SCA: security update for langgraph-api (GHSA-jfj5-wrj9-63x4)

medium Tenable Cloud Security Plugin ID 477854

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the
 langgraph-api run-creation path authorizes the assistant attached to a run by dispatching
 assistants.search with an incomplete value instead of the assistants.read event used by direct reads and
 cron creation. In deployments with custom resource handlers that register only assistants.read, omit an
 assistants.search handler, and have no global fallback handler, no applicable handler supplies an owner
 filter, allowing a low-privileged user to reference another user's private assistant through POST /runs or
 POST /threads/{thread_id}/runs. The run-creation response can disclose the private assistant's metadata,
 config, and context, and the run can execute using that assistant's configuration. Deployments without
 custom authorization handlers, or with an equivalent owner filter applied through a global handler or
 across all assistant events, are not affected. This issue is fixed in version 0.10.0. (CVE-2026-55236)

Solution

Update the langgraph-api library and its related packages to version 0.10.0 or later.

See Also

https://github.com/advisories/GHSA-jfj5-wrj9-63x4

Plugin Details

Severity: Medium

ID: 477854

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.68

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:P/A:N

CVSS Score Source: CVE-2026-55236

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/19/2026

Vulnerability Publication Date: 8/19/2026

Reference Information

CVE: CVE-2026-55236

cwe: CWE-285