LangGraph SDK resource decorator actions parameter is ignored

1. 06:49
   GitHub 安全公告Selected

   LangGraph SDK fixes authorization vulnerability where resource decorators silently ignore the actions parameter

   LangGraph SDK resource-level authorization decorators (including @auth.on.threads, @auth.on.assistants, and @auth.on.crons) incorrectly ignore the actions= parameter, registering handlers that should only be registered for specific actions to all actions of that resource. Because resource-level handlers take precedence over broader fallback handlers, authorization checks in fallback handlers may no longer execute, and authenticated users may be able to read, update, or delete other users' resources. The impact is limited to Python deployments that use actions= on the affected decorators; if the handler itself independently performs action, ownership, or permission checks on every request, it remains protected. This vulnerability was fixed in version 0.4.4, and no temporary mitigation is available.

Current attention 55·Peak in the comparable period 56 (Oct 7 12:00)·Change over the comparable past 24 hours 0%