CVE-2026-14742: langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash
A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function freeze of the file libs/langgraph/langgraph/internal/cache.py of the component Task Result Cache. This manipulation of the argument defaultcachekey causes use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14742?
The severity of CVE-2026-14742 is low, rated at 3.1.
How do I fix CVE-2026-14742?
To fix CVE-2026-14742, update langchain-ai langgraph to version 1.2.5 or later.
What component is affected by CVE-2026-14742?
CVE-2026-14742 affects the Task Result Cache component in langchain-ai langgraph.
What causes the vulnerability in CVE-2026-14742?
The vulnerability in CVE-2026-14742 is caused by the manipulation of the default_cache_key argument which results in the use of a weak hash.
What is the potential impact of CVE-2026-14742?
The potential impact of CVE-2026-14742 includes exposure to attacks that can exploit weak hash functions.