CVE-2026-115883 in langgraph-checkpoint-postgres
Summary
by MITRE • 10/24/2026
LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples. This issue is fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability resides within the LangGraph checkpoint saver components, specifically affecting PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore prior to versions 3.1.3 and 3.1.2 respectively. These components are responsible for providing state persistence for LangGraph workflows and agents by storing data in PostgreSQL or SQLite databases. The core technical flaw stems from an inconsistent validation mechanism applied to namespace labels during different operations. While the BaseStore class performs validation checks on namespace labels when executing put and aput methods, it fails to apply equivalent validation logic to read-oriented and management operations such as get, search, delete, list_namespaces, their asynchronous counterparts, or direct batch processing functions like abatch. This discrepancy creates a critical security gap where unvalidated input can bypass intended access controls.
The operational impact of this flaw is severe due to the way namespace labels are processed in the affected store implementations. These stores flatten namespace labels by joining them with dots using the join method on the namespace tuple or list. Because validation is absent for retrieval and deletion operations, an attacker who can supply crafted input containing dot characters within a namespace label can manipulate how that label resolves against stored data structures. In multi-tenant environments where different users or services share the same database backend but are logically separated by namespaces, this flaw allows cross-namespace access. An actor with permissions to write to one namespace could potentially read from, overwrite, or delete state associated with another tenant's namespace if they can control the input passed through vulnerable methods like get or search. This effectively breaks the isolation guarantees expected in multi-user applications relying on these checkpoint savers for state management.
This vulnerability is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK techniques related to unauthorized access and data exfiltration, specifically within the context of application layer attacks where logical flaws allow privilege escalation or lateral movement between isolated contexts. It is important to note that the InMemoryStore implementation is not affected by this issue because it compares namespace tuples directly rather than flattening them into string-based keys with dot separators. This architectural difference inherently prevents the specific path traversal-like behavior observed in the database-backed stores, as tuple comparison does not suffer from ambiguity regarding delimiter interpretation or label resolution across boundaries.
To mitigate this risk, organizations using LangGraph checkpoint savers must immediately upgrade to langgraph-checkpoint-postgres version 3.1.3 and langgraph-checkpoint-sqlite version 3.1.2 or later. These updated versions address the validation gap by ensuring that namespace labels are consistently validated across all operations, not just write methods. Until an upgrade is possible, administrators should implement strict input sanitization at the application layer to prevent dot characters from being passed as part of namespace identifiers in get, search, delete, and batch operations. Additionally, reviewing database access policies and isolating tenant data where feasible can reduce the blast radius if exploitation occurs. Regular security audits focusing on state persistence mechanisms are recommended to identify similar inconsistencies in other components that handle multi-tenant isolation logic.