CVE-2026-115885: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
langgraph deploy --verbose printed the temporary registry push token that the CLI uses to log Docker in to the deployment’s image registry. Anyone who could read that output, for example in CI logs, could use the token until it expired.
References
- github.com/advisories/GHSA-8prr-f582-jqq3
- github.com/langchain-ai/langgraph/commit/1afaca35a0d4962fb0203a0e9133a07ffd6a553c
- github.com/langchain-ai/langgraph/pull/8482
- github.com/langchain-ai/langgraph/releases/tag/cli%3D%3D0.4.32.dev0
- github.com/langchain-ai/langgraph/security/advisories/GHSA-8prr-f582-jqq3
- nvd.nist.gov/vuln/detail/CVE-2026-115885
Code Behaviors & Features
Detect and mitigate CVE-2026-115885 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →