LangGraph SDK has unsafe URL path construction

Vulnerability

The LangGraph Python SDK (langgraph-sdk) constructs HTTP request paths by interpolating caller-supplied identifier values into URL templates. Versions 0.3.14 and prior fail to sanitize these values before inclusion in the path. An identifier containing URL-special characters (e.g., ../) can alter the resulting request path, potentially addressing a different resource or resource type than the SDK method intended [1].

Exploitation

An attacker needs the ability to supply identifier values to SDK methods, typically via end-user input forwarded directly into SDK parameters without prior validation. No special network position is required beyond normal application access. By providing a crafted identifier (e.g., ../../other-resource/), the attacker causes the SDK to issue an HTTP request to a path the developer did not intend, effectively hijacking the operation [1].

Impact

Successful exploitation can lead to unintended access, modification, or deletion of LangGraph resources beyond the user's authorization scope. The impact is most severe in deployments relying on URL-prefix-based authorization (e.g., reverse proxy, WAF), where the authorization decision is made on the intended path rather than the manipulated final request path [1].

Mitigation

The issue was fixed in langgraph-sdk version 0.3.15, released on June 16, 2026, by percent-encoding caller-supplied identifiers in URL paths [2]. Users should upgrade to >=0.3.15. As a workaround, applications should validate identifier values (e.g., parse as UUID) before passing them to SDK methods; doing fully eliminates the attack surface [1]. No evidence of exploitation in the wild has been reported.