CVE-2026-115885: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Q: Which deployments are exposed to this token disclosure?

The issue affects deployments made with langgraph deploy --verbose using the affected CLI versions. Deployments run without --verbose and deployments using remote image builds are not affected.

Q: What would an attacker need to exploit the exposed token, and what could they do with it?

An attacker would need access to CI logs or terminal recordings containing the verbose output before the temporary token expires, which can be up to 12 hours. The token can allow pulling deployment images or pushing images to that deployment's image repository, but it cannot by itself update a deployment to execute a pushed image.

Q: What should be done if an affected deployment command may have exposed a token?

Upgrade to langgraph-cli version 0.4.32, which fixes the issue. Until upgrading, do not use --verbose for deployments and restrict access to CI logs and terminal recordings; any exposed token has a maximum 12-hour lifetime.

Q: How can teams determine whether they were affected?

Review deployment invocations and associated CI logs or terminal recordings for use of langgraph deploy --verbose with CLI versions from 0.4.15 until the fixed 0.4.32 release. Exposure requires that the command input containing the temporary registry push token was visible to someone able to read those logs or recordings.

Published Oct 23, 2026

Updated

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image. This issue is fixed in version 0.4.32.

Affected Software

1 affected component

pypi/langgraph-cli>=0.4.15<0.4.32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LangGraph CLI to a version that resolves this vulnerability.
Fixed in 0.4.32

Event History

Oct 23, 2026

CVE Published

via MITRE·09:15 PM

Data Sourced

via MITRE·09:15 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this token disclosure?

The issue affects deployments made with langgraph deploy --verbose using the affected CLI versions. Deployments run without --verbose and deployments using remote image builds are not affected.

What would an attacker need to exploit the exposed token, and what could they do with it?

An attacker would need access to CI logs or terminal recordings containing the verbose output before the temporary token expires, which can be up to 12 hours. The token can allow pulling deployment images or pushing images to that deployment's image repository, but it cannot by itself update a deployment to execute a pushed image.

What should be done if an affected deployment command may have exposed a token?

Upgrade to langgraph-cli version 0.4.32, which fixes the issue. Until upgrading, do not use --verbose for deployments and restrict access to CI logs and terminal recordings; any exposed token has a maximum 12-hour lifetime.

How can teams determine whether they were affected?

Review deployment invocations and associated CI logs or terminal recordings for use of langgraph deploy --verbose with CLI versions from 0.4.15 until the fixed 0.4.32 release. Exposure requires that the command input containing the temporary registry push token was visible to someone able to read those logs or recordings.

CVE-2026-115885: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this token disclosure?

What would an attacker need to exploit the exposed token, and what could they do with it?

What should be done if an affected deployment command may have exposed a token?

How can teams determine whether they were affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this token disclosure?

What would an attacker need to exploit the exposed token, and what could they do with it?

What should be done if an affected deployment command may have exposed a token?

How can teams determine whether they were affected?