LangGraph JS and TypeScript custom authorization handlers could rewrite a Store namespace to the signed-in user but later server execution used the original untrusted namespace. The flaw required an application relying on a rewrite-style custom auth handler; rejecting unauthorized operations outright and the Python implementation followed different paths.…
Inspect the ClaimsCase · DiggingBeagle record
LangGraph JS Store discarded an authorization-rewritten namespace
LangGraph JS and TypeScript custom authorization handlers could rewrite a Store namespace to the signed-in user but later server execution used the original untrusted namespace. Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.
Scope
The flaw required an application relying on a rewrite-style custom auth handler; rejecting unauthorized operations outright and the Python implementation followed different paths. This is CVE-2026-118668, distinct from the earlier LangGraph dot-joined namespace-collision advisory and without a published victim count.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: A custom authorization handler may safely rewrite a requested Store namespace, but the effective operation must use that rewritten value.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-LANGGRAPH-AUTH-DISCARD-1 · CLM-ENRICH-20261029-11 · LangGraph JS Store auth rewrite loss, CVE-2026-118668
At a glance
Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.
Read the implicationsThis is CVE-2026-118668, distinct from the earlier LangGraph dot-joined namespace-collision advisory and without a published victim count.
Limits and uncertaintyFull account
LangGraph JS and TypeScript custom authorization handlers could rewrite a Store namespace to the signed-in user but later server execution used the original untrusted namespace.
The flaw required an application relying on a rewrite-style custom auth handler; rejecting unauthorized operations outright and the Python implementation followed different paths. Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.
This is CVE-2026-118668, distinct from the earlier LangGraph dot-joined namespace-collision advisory and without a published victim count. Upgrade langgraph-api to 0.15 or newer and verify that the authorization-transformed Store parameters are the exact parameters executed.
Evidence interpretation and control boundary. A custom authorization handler may safely rewrite a requested Store namespace, but the effective operation must use that rewritten value. In affected JavaScript and TypeScript deployments the transformed request was lost before storage execution; this is distinct from LangGraph namespace delimiter collisions, which involve how otherwise distinct identity tuples are serialized. Reject-only handlers and Python handlers have separate exposure.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-11The LangGraph advisory limits the weakness to JavaScript/TypeScript custom-auth Store handlers that depend on namespace rewriting; version 0.15.0 carries the rewritten namespace into the executing Store request.supported
Basis: reported finding
- supportsLangGraph JS Store auth rewrite loss, CVE-2026-118668primary disclosure
GHSA-4hm6-w6qq-w73v: JS/TS auth rewriting, request execution mismatch, fixes
CLM-CP23-LANGGRAPH-AUTH-DISCARD-1LangGraph JS and TypeScript custom authorization handlers could rewrite a Store namespace to the signed-in user but later server execution used the original untrusted namespace. The flaw required an application relying on a rewrite-style custom auth handler; rejecting unauthorized operations outright and the Python implementation followed different paths. Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.supported
Basis: reported finding
- supportsLangGraph JS Store auth rewrite loss, CVE-2026-118668primary disclosure
GHSA-4hm6-w6qq-w73v: JS/TS auth rewriting, request execution mismatch, fixes
Implications
Store read, search, write or delete could cross the intended user namespace even though the handler appeared to scope the request.
Controls and mitigations
- Upgrade langgraph-api to 0.15 or newer and verify that the authorization-transformed Store parameters are the exact parameters executed.
Unknowns and contradictions
- This is CVE-2026-118668, distinct from the earlier LangGraph dot-joined namespace-collision advisory and without a published victim count.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202