Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-48776: langgraph-sdk could let attackers control the application
CVE-2026-48776 · published 1 day ago
Summary
The langgraph‑sdk library used in your Python projects has a security weakness that could allow an attacker to take control of the software that uses it. This could lead to unauthorized actions or data exposure. Install one of the newly released fixed versions of langgraph‑sdk as soon as possible to remove the risk.
What to do
- Update langgraph-sdk to version 0.3.15.
- Update rootio-langgraph-sdk to version 0.3.14+root.io.1.
- Update langgraph-sdk to version 0.3.14+aikido.3.
- Update langchain langgraph-sdk to version 0.3.15 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | langgraph-sdk |
< 0.3.15 Fix: upgrade to 0.3.15
|
| – | langchain | langgraph-sdk |
< 0.3.15 cpe:2.3:a:langchain:langgraph-sdk:*:*:*:*:*:python:*:* |
| Root:PyPI | – | rootio-langgraph-sdk |
< 0.3.14+root.io.1 Fix: upgrade to 0.3.14+root.io.1
|
| Root:PyPI | – | langgraph-sdk |
< 0.3.14+aikido.3 Fix: upgrade to 0.3.14+aikido.3
|
Original advisory text
CVE-2026-48776 in langgraph-sdk - Patched by Root
Root has patched CVE-2026-48776 in the langgraph-sdk package for Root:PyPI. Multiple fixed versions available.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-22Path Traversal
CWE-863Incorrect Authorization
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen25 Jun 2026
Track software like this
Free during beta