CVE-2026-115885
Description
A flaw was found in LangGraph CLI. When deploying applications with verbose logging enabled, the tool inadvertently outputs temporary container registry authentication tokens to the console. An unauthorized user with read access to terminal recordings or continuous integration (CI) build logs can capture these active tokens. This credential disclosure allows attackers to pull deployment images or upload unauthorized images to the affected container repository before the tokens expire.
Statement
This vulnerability is rated as Moderate severity because credential exposure is restricted to non-default verbose execution and requires an attacker to access build logs or terminal output within the brief validity window of the token. Under standard deployment configurations where verbose logging is disabled or remote builds are utilized, registry authentication secrets are not printed to output streams. Furthermore, possession of the registry token alone permits repository read and write access but does not grant authorization to redeploy or modify running application instances.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
