The LangGraph Python SDK, between versions 0.1.45 and 0.4.4, contains a flaw in its resource‑scoped authentication decorators. The @auth.on.threads, @auth.on.assistants, and @auth.on.crons decorators ignore the supplied actions argument and register a handler for every action on the target resource. Because this wildcard handler is selected before any broader fallback handlers, a user who has authenticated can bypass fallback action, ownership, or permission checks and read, update, or delete another user’s resource. The vulnerability therefore leads to privilege escalation and loss of confidentiality, integrity, and availability of user data.

Deployments that use the langchain‑ai:langgraph LangGraph SDK between versions 0.1.45 and 0.4.4 and that apply the @auth.on.threads, @auth.on.assistants, or @auth.on.crons decorators with an actions parameter are potentially affected. The issue exists only when the application relies on the actions argument; deployments that do not use this feature or that have their own handler logic that fully validates every action remain safe. The fix was introduced in SDK version 0.4.4, which is available in the 0.4.4 release channel.

The CVSS score of 7.6 indicates a moderate‑to‑high severity flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a Python application that connects to a LangGraph API server using the buggy SDK. An attacker who can obtain an authenticated session (for example, by credential theft or OAuth token leakage) can invoke any handler without restriction, effectively bypassing the intended access controls. Because the flaw is exercised when the actions argument is used, developers who have disabled that parameter or who enforce action checks in their own handlers will not be exposed. However, many real‑world applications rely on the automatic enforcement of actions, making the vulnerability widely exploitable if the patch is not applied in a timely fashion.