Topic

Cve 2026 104873

Coverage tagged cve 2026 104873.

Articles: 1
Desk: 1

CVSS v4.0 score 7.6 High for CVE-2026-104873: one handler, every action; langgraph-sdk 0.1.45 to before 0.4.4 affected, fixed in 0.4.4

elevatedAI Security Cve 2026 104873

LangGraph SDK Auth Bug: `actions=` Ignored on `@auth.on` Handlers (CVE-2026-104873)

A langgraph-sdk bug applied actions=-scoped auth handlers to every action, so an authenticated user could reach others' threads. Fixed in 0.4.4; what to check.

Oct 3 · 6 min