The langgraph-api module includes custom authentication handlers that operate on a Store namespace. Between releases 0.1.2 and 0.15.0, JavaScript or TypeScript handlers could rewrite the namespace value before it is applied to the Store operation, but this rewritten value was not carried across the runtime boundary. As a result an attacker who is authenticated to the system could trick the handler into using a namespace belonging to another user. By doing so the attacker can read, modify, delete, or search records stored under that other user’s namespace. This behavior is reflected in CWE‑639 (Authorization Bypass through User-Controlled Key) and CWE‑863 (Incomplete Authorization). The vulnerability permits confidentiality compromise and integrity violation for user data within a single deployment that relies on namespace rewriting for isolation.

The affected product is langchain‑ai:langgraph‑api. Versions from 0.1.2 up to and including 0.15.0 are impacted. The issue does not affect Python custom authentication or handlers that reject unauthorized namespaces. Any deployment using the JavaScript or TypeScript custom authentication with namespace rewriting for isolation is at risk.

The CVSS score of 8.6 classifies the vulnerability as high. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The likely attack surface requires an authenticated user with the ability to configure or submit a custom authentication handler; once this condition is met, the attacker can gain unrestricted access to another user’s Store namespace. Consequently, the risk is significant for services that rely on langgraph-api to store confidential data across multiple users.