In langgraph-api 0.1.2 up to (not including) 0.15.0, when a deployment used JavaScript or TypeScript custom authentication and its Store handler limited users by rewriting the requested namespace to their own, the rewrite was dropped before the Store operation ran. An ordinary authenticated user could then read, overwrite, search or delete other users' long-term agent memory and data. No admin rights, user interaction or race is needed.

• Not affected: Python auth handlers, and JS/TS handlers that reject unauthorized namespaces instead of rewriting them.
• Fixed: langgraph-api 0.15.0 carries the handler's changes across the runtime boundary, validates the resulting namespace and rejects malformed changes.
• Workaround: change every Store action handler to deny requests for namespaces the user does not own.

Context: this is the second LangGraph Store isolation bug on this site in a week (see CVE-2026-115883, Oct 24). If you run multi-tenant agents on LangGraph, test isolation with two real user accounts after upgrading, and check Store logs for cross-namespace reads.