CVE-2026-104873

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Published

Oct 2, 2026, 8:06:07 PM UTC

Updated

Oct 2, 2026, 8:17:01 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 27, 2026

A flaw was found in langgraph-sdk. This vulnerability allows an authenticated attacker to bypass authorization controls to access, modify, or delete resources belonging to other users. The issue occurs because resource-scoped authorization decorators fail to restrict handlers to specified actions, inadvertently registering wildcard handlers that override fallback permission and ownership checks. langgraph-sdk: langgraph-sdk: Authorization bypass via improper resource handler registration This flaw is rated as having Important impact because authenticated remote users could bypass intended authorization boundaries in multi-tenant environments, resulting in unauthorized access or modification of sensitive resources. In Red Hat products integrating this SDK, exposure is limited to environments where custom authentication policies filter specific resource operations. Furthermore, the issue only presents a risk if the custom handler does not enforce permissions across all attempted operations independently. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.