PT-2026-55787 · Langchain Ai · Langgraph

Dem0 · Published 2026-07-05 · Updated 2026-07-05 · CVE-2026-14742

NVD

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:P/I:N/A:N

A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function freeze of the file libs/langgraph/langgraph/ internal/ cache.py of the component Task Result Cache. This manipulation of the argument default cache key causes use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Exploit

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2026-14742

Affected Products

Langgraph

References · 8

• 🔥 https://github.com/langchain-ai/langgraph/issues/8009 · Exploit
• https://github.com/langchain-ai/langgraph/pull/8069 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14742 · Security Note
• https://vuldb.com/submit/849217 · Note
• https://github.com/langchain-ai/langgraph · Note
• https://vuldb.com/vuln/376328 · Note
• https://vuldb.com/cve/CVE-2026-14742 · Note
• https://vuldb.com/vuln/376328/cti · Note