LangGraph SDK v3 streaming incorrectly interpolates caller-provided assistant_id and thread_id values into authenticated GET request paths without proper encoding. Relative path segments in these identifiers can be interpreted by the server as navigation to alternative paths while the original authentication headers are preserved, potentially allowing an authenticated attacker to redirect requests to unintended endpoints that may expose sensitive data. This flaw constitutes a path traversal issue (CWE-22) and can lead to information disclosure or unauthorized access to data the attacker would not normally see. The impact is contingent on the presence of sufficient authentication and unprotected server endpoints, but the potential for data leakage exists.

The vulnerability affects the LangChain AI langgraph and langgraph-sdk products. Specifically, all versions of langgraph-sdk from 0.4.0 through 0.4.6 and all versions of langgraph from 1.2.3 through 1.2.14 are impacted when RemoteGraph v3 streaming uses the exposed SDK. Updating to langgraph-sdk 0.4.6 or later, or langgraph 1.2.14 or later, removes the flaw.

The CVSS score for this vulnerability is 4.3, indicating a moderate severity that is unlikely to allow remote code execution but may still compromise confidentiality or integrity of data. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation activity may be limited. The likely attack vector requires an authenticated user to supply crafted assistant_id or thread_id values; it does not require network-level access beyond that. Because the attacker must first obtain or compromise legitimate credentials to the LangGraph API, the overall risk remains moderate. Nevertheless, organizations that rely on strict access controls or store sensitive information should prioritize remediation.