langchain-ai vulnerabilities
54 published CVEs name langchain-ai among the affected products.
- 54Published CVEs54 of them scored
- 38Last 12 monthspublished in the last year
- 1Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-118668
LangGraph JavaScript custom authentication may permit cross-user Store access
langchain-ai · langgraph-api
High8.6 - CVE-2026-118667
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
langchain-ai · langgraph
Medium4.3 - CVE-2026-115885
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
langchain-ai · langgraph
Medium4.1 - CVE-2026-115883
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
langchain-ai · langgraph
Medium6.0 - CVE-2026-106119
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
langchain-ai · langchainjs
Medium6.0 - CVE-2026-105799
LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
langchain-ai · langchainjs
Low2.3 - CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
langchain-ai · langgraph
High7.6 - CVE-2026-55253
LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
langchain-ai · langchain-mongodb
High7.7 - CVE-2026-55235
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
langchain-ai · langgraph-api
Medium5.9 - CVE-2026-55236
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
langchain-ai · langgraph-api
Medium5.9