MEDIUM 5.9 GitHub
CVE-2026-55235
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
## Summary
In affected versions of `langgraph-api` (the LangGraph Server runtime), a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the authentication middleware treats as internal and does not authenticate. As a result, a relative webhook target could reach the server's own routes that operate on threads and runs without the authenticat
Affected Products
- pip/langgraph-api < 0.10.0
References
- https://github.com/advisories/GHSA-2c9q-c2q9-qgqv
- https://github.com/langchain-ai/helm/security/advisories/GHSA-2c9q-c2q9-qgqv
- https://github.com/advisories/GHSA-2c9q-c2q9-qgqv
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-08-19 via GitHub. Affected: pip/langgraph-api < 0.10.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.