Insecure Session Identifier Handling in LangChain Framework

CVE-2026-106119

What is CVE-2026-106119?

The LangChain framework contains a vulnerability in its MongoDBChatMessageHistory component where untrusted session identifiers can be misprocessed. This allows an attacker to exploit the system by manipulating the session identifier. Instead of treating it as a literal value, the system may interpret it as a MongoDB query condition. Consequently, an attacker with the capability to invoke chat-history operations can gain unauthorized access to, alter, or delete conversations stored by other users in shared MongoDB collections. This issue has been addressed in version 1.3.1.

References