LangChain published two GitHub Security Advisories against langgraph-api — the LangGraph Server runtime behind LangGraph Platform, including the official Helm chart — at 18:55:57 and 18:56:03 UTC on 19 August. Both are cross-tenant authorisation failures in a production agent runtime.
The two bugs
CVE-2026-55236 (CVSS 5.9, confidentiality-led): the run-creation path dispatched an assistants.search authorisation event while direct reads and cron operations dispatched assistants.read. In deployments whose custom handler gated assistant access on assistants.read without a global fallback, no handler was consulted at all on run creation — the owner constraint dropped out and another user's private assistant metadata, config and context came back in the response.
CVE-2026-55235 (CVSS 5.9, integrity-led): a run or cron could specify a relative webhook target. Delivery then looped back into the same application over an in-process transport that the authentication middleware treats as internal and does not authenticate, letting a request create runs on or modify the state of another user's threads.
What the common telling gets wrong
This will be reported as new vulnerabilities found in LangGraph. Two corrections. First, the fix has been on PyPI since 11 June 2026 — the first patched version is 0.10.0, and fourteen further releases have shipped since, up to 0.12.6 on 18 August. Anyone on a remotely current version was never exposed. What happened on 19 August was disclosure, not discovery, and not a scramble.
Second, "cross-tenant data exposure in agent platform" overstates the blast radius. CVE-2026-55236 only bites deployments that wrote a custom authorisation handler registering assistants.read or assistants.search without a global handler; LangChain's own advisory says deployments with no custom handlers, or with equivalent owner filters across all events, are unaffected. Both advisories state plainly: "We have no evidence of this behavior occurring in the wild."
The shape of the bug is the story
Both flaws come from the same failure mode — an agent runtime with more than one internal path to the same resource, where the authorisation event name diverges on one of them, plus an "internal" transport that skips authentication entirely. Agent servers accumulate exactly these surfaces: webhooks, crons, threads and runs all touching shared state through different entry points. This class of finding will keep recurring for structural reasons, not because of any one team's carelessness.