PyPI/langgraph-sdk CVE-2026-104873: unknown, EPSS 0.25%

LangGraph SDK custom auth silently ignores actions= on resource decorators

Action: Upgrade langgraph-sdk to 0.4.4 or later.

pip install langgraph-sdk==0.4.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4240
• https://github.com/langchain-ai/langgraph/security/advisories/GHSA-fvww-7h3r-vfhp
• https://nvd.nist.gov/vuln/detail/CVE-2026-104873
• https://github.com/langchain-ai/langgraph/commit/5a77be5e8bec1600ad0a865638d88c1368497559
• https://github.com/langchain-ai/langgraph
• https://github.com/langchain-ai/langgraph/releases/tag/sdk==0.4.4
• https://pypi.org/project/langgraph-sdk
• https://github.com/advisories/GHSA-fvww-7h3r-vfhp

CVE-2026-104873 · published 2026-10-15T10:22:44.441452Z · modified 2026-10-15T14:45:12.944430612Z · JSON