The LangGraph Python SDK v3 streaming client interpolates caller-supplied thread_id and assistant_id values into request paths without encoding them at four synchronous and asynchronous call sites. Relative path segments can therefore redirect an authenticated GET request to another path on the same configured server.
What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: @auth.on.threads(actions=["create"]) async def allow_thread_create(ctx, value): return None intended to register a handler for selected actions instead registers that handler for every action on the resource. Because the resource-wide handler is selected before broader fallback handlers, authorization checks implemented in …
langgraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to address a different resource (and potentially a different resource type) than the SDK method's call site indicates. In deployments where the SDK receives identifier values that originate from untrusted sources, this could result …