Namespace Exposure Vulnerability in LangGraph's Checkpoint Postgres and SQLite Implementations

CVE-2026-71433

What is CVE-2026-71433?

The Checkpoint Postgres and SQLite implementations in LangGraph allow hierarchical namespaces to be exposed due to flawed handling of dot joined strings. This means an authenticated user can unintentionally gain access to another user's data or namespace through unsophisticated scoped search queries. The vulnerability arises from how the libraries persist and retrieve these namespaces, as they use simple prefix pattern matching that does not adequately isolate tenant data. This issue has been remedied in version 3.1.1 of both the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages.

References