Low severity · published Jul 5, 2026
CVE-2026-14742
langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. This manipulation of the argument default_cache_key causes use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langgraph · langchain-ai
1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4 · source: vendor
Affected product
LA
langgraph
langchain-ai
More from langgraph
7.8
CVE-2025-67644
LangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list method
7.6
CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
7.4
CVE-2025-64439
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
7.3
CVE-2025-64104
LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore
7.2
CVE-2026-28277
LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading