{"id":"ghsa-ghsa-4hm6-w6qq-w73v","seq":2056943,"kind":"advisory","title":"LangGraph JavaScript custom authentication may permit cross-user Store access","url":"https://github.com/advisories/GHSA-4hm6-w6qq-w73v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4hm6-w6qq-w73v","summary":"影響: pip:langgraph-api >= 0.1.2, < 0.15.0 → 0.15.0\nLangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace. Required conditions A deployment is affected only when all of the following conditions apply: - It uses an affected langgraph-api version. - It runs JavaScript or TypeScript custom authentication. - Its Store authorization h…","severity":"high","techs":["python","nodejs"],"cves":["CVE-2026-118668"],"tags":["GHSA-4hm6-w6qq-w73v","langgraph-api"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:09:42.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}