CVE-2026-118668: LangGraph JavaScript custom authentication may permit cross-user Store access

October 28, 2026

LangGraph deployments using JavaScript or TypeScript custom authentication may fail to apply Store authorization changes returned by an authorization handler. In affected deployments, an authenticated user may be able to access Store data outside their authorized namespace.

References

github.com/advisories/GHSA-4hm6-w6qq-w73v
github.com/langchain-ai/langgraph/security/advisories/GHSA-4hm6-w6qq-w73v
nvd.nist.gov/vuln/detail/CVE-2026-118668

Code Behaviors & Features

Detect and mitigate CVE-2026-118668 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →