THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jfj5-wrj9-63x4 (medium) — langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

[GHSA] GHSA-jfj5-wrj9-63x4 (medium) — langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

medgithub_advisoriesPublished 2026-08-19

GHSA-jfj5-wrj9-63x4 Severity: medium CVE: CVE-2026-55236

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

## Summary

In affected versions of `langgraph-api` (the LangGraph Server runtime), the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant re

Indicators of compromise

CVE-2026-55236cve

Original source: https://github.com/advisories/GHSA-jfj5-wrj9-63x4