Injection Vulnerability in LangChain MongoDB Integrations Affects Data Isolation

CVE-2026-55253

What is CVE-2026-55253?

The LangChain MongoDB integrations have a critical issue where certain methods incorporate unvalidated filter dictionaries into MongoDB queries. Authenticated users can manipulate incoming filter arguments, enabling them to inject MongoDB Query Language operators like $regex or $where. This vulnerability poses a significant threat in multi-tenant environments, as it could allow users to bypass intended data access controls and view other users' checkpoint or store data. The issue is effectively mitigated in versions 0.3.0 of langgraph-checkpoint-mongodb and 0.4.0 of langgraph-store-mongodb, which implement necessary safeguards against such injection attacks.

References