LangGraph deploy obtained a limited registry credential from its control plane and passed it on standard input to Docker login. A verbose subprocess helper also printed stdin, making the temporary token readable in CI logs or terminal captures. Possession of the token during its validity period could permit image pull or replacement in the target deployment…
Inspect the ClaimsCase · DiggingBeagle record
LangGraph verbose deploy output disclosed a temporary image registry token
The reviewed LangGraph CLI advisory says versions 0.4.15 through 0.4.31 printed a registry push token to verbose logs during local-image deployment; version 0.4.32 removed the sensitive log.
Agent isolation requires bounding indirect outbound authority through allowed servicesStolen AI credentials as attack infrastructure
Scope
Requires the verbose flag, local image build and readable output; token was limited to one image repository for at most twelve hours.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The project report describes temporary registry credentials in verbose deployment output. The presence of a token in a log is evidence of exposure to log readers, not proof that a third party subsequently used it. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-LANGGRAPH-VERBOSE-TOKEN-1 · LangGraph CLI registry token logged in verbose deployment, GHSA-8prr-f582-jqq3
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsRequires the verbose flag, local image build and readable output; token was limited to one image repository for at most twelve hours.
Limits and uncertaintyFull account
LangGraph deploy obtained a limited registry credential from its control plane and passed it on standard input to Docker login. A verbose subprocess helper also printed stdin, making the temporary token readable in CI logs or terminal captures. Possession of the token during its validity period could permit image pull or replacement in the target deployment repository. The disclosure is about credential leakage from the agent deployment tooling, not an exploit of model reasoning.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-LANGGRAPH-VERBOSE-TOKEN-1The reviewed LangGraph CLI advisory says versions 0.4.15 through 0.4.31 printed a registry push token to verbose logs during local-image deployment; version 0.4.32 removed the sensitive log.supported
Basis: reported finding
- supportsLangGraph CLI registry token logged in verbose deployment, GHSA-8prr-f582-jqq3primary disclosure
GHSA-8prr-f582-jqq3, Summary, Details, Impact, affected and patched versions
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade langgraph-cli to 0.4.32, redact subprocess input in deployment logs and rotate affected registry credentials if logs were exposed before expiry.
Unknowns and contradictions
- Requires the verbose flag, local image build and readable output; token was limited to one image repository for at most twelve hours.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211