A flaw was found in langgraph-sdk. This vulnerability allows an authenticated attacker to bypass authorization controls to access, modify, or delete resources belonging to other users. The issue occurs because resource-scoped authorization decorators fail to restrict handlers to specified actions, inadvertently registering wildcard handlers that override fallback permission and ownership checks.
Last checked: 2026-10-06 16:33 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-05 14:46 UTC)
Fix evidence last checked: 2026-10-06 19:50 UTC