Detections
Analytics

SCA: security update for langgraph-sdk (GHSA-fvww-7h3r-vfhp)

high Tenable Self-Hosted Container Security Plugin ID 472984

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and
 stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped
 authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions
 argument and register the selected handler for every action on the resource. Because that wildcard
 resource handler is selected before broader fallback handlers, an authenticated user may bypass fallback
 action, ownership, or permission checks and read, update, or delete another user's resource. Only Python
 deployments using actions on the affected decorators are vulnerable, and a deployment remains protected
 when the selected handler independently enforces all required checks for every action it receives. This
 issue is fixed in version 0.4.4. (CVE-2026-104873)

Solution

Update the langgraph-sdk library and its related packages to version 0.4.4 or later.

See Also

https://github.com/advisories/GHSA-fvww-7h3r-vfhp

Plugin Details

Severity: High

ID: 472984

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.41

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-104873

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.6

Threat Score: 4.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-104873

cwe: CWE-863