Cross-Namespace Vulnerability in LangGraph Checkpoint Save Functionality
CVE-2026-115883
6MEDIUM
What is CVE-2026-115883?
The LangGraph checkpoint savers exhibit a cross-namespace vulnerability due to improperly validated namespace labels in versions prior to 3.1.3 for Postgres and 3.1.2 for SQLite. This flaw allows attackers to exploit unvalidated dotted labels during operations such as get, search, and delete, potentially accessing or altering another tenant's stored data. The InMemoryStore remains unaffected as it validates namespace tuples. An upgrade to the fixed versions is crucial to mitigate this risk.
Affected Version(s)
langgraph < 1.2.15
langgraph-checkpoint-postgres < 3.1.3
langgraph-checkpoint-sqlite < 3.1.2