CVE-2026-14742 is a vulnerability in langchain-ai langgraph up to version 1.2.4 affecting the _freeze function in libs/langgraph/langgraph/_internal/_cache.py within the Task Result Cache component. The vulnerability arises from the use of a weak hash due to manipulation of the default_cache_key argument. The attack can be performed remotely with high complexity and difficult exploitability. Although the exploit has been publicly disclosed, no official remediation or patch has been released yet; a pull request with a fix is awaiting acceptance.

The vulnerability allows remote attackers to exploit the use of a weak hash in the caching mechanism, potentially undermining cache integrity or security. However, the low CVSS score (2.3) and high attack complexity indicate limited practical impact and difficulty in exploitation. There is no indication of privilege escalation, user interaction, or direct data compromise from the available information.

No official fix or patch is currently available. A pull request addressing the issue exists but is pending acceptance. Users should monitor the vendor's repository or advisories for the acceptance and release of the fix. Until then, no specific mitigation actions are confirmed by the vendor.