CVE-2026-71433 in langgraph-checkpoint-postgres
Summary
by MITRE • 08/07/2026
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a sibling namespace whose flattened form shares the same leading characters, or a namespace label containing unescaped pattern metacharacters, allowing an authenticated caller to retrieve stored items belonging to another tenant or user through an ordinary scoped search or list namespaces call, with no crafted input required. This issue is fixed in versions 3.1.1 of langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects LangGraph's checkpoint storage implementations for both Postgres and SQLite databases, specifically within the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages. This security flaw exists in versions prior to 3.1.1 and represents a critical access control bypass that allows unauthorized data retrieval across tenant or user boundaries. The vulnerability stems from an improper implementation of namespace scoping mechanisms that handle hierarchical naming structures within the checkpoint storage system.
The technical flaw manifests in how the system processes hierarchical namespaces by flattening them into dot-joined strings for storage purposes. When performing read operations, the system employs simple prefix matching to scope access to specific namespaces, which creates a fundamental security gap. This approach fails to properly escape or sanitize namespace identifiers, particularly when they contain pattern metacharacters that could be interpreted by the underlying database query system. The prefix matching mechanism treats the flattened namespace string as a literal pattern rather than properly escaping special characters, leading to potential injection-like behavior in the namespace resolution process.
The operational impact of this vulnerability is significant for multi-tenant environments where isolation between different users or organizations is critical. An authenticated attacker with access to the checkpoint storage system can exploit this flaw by performing ordinary scoped search or list namespaces operations without requiring any specially crafted input. The vulnerability allows cross-tenant data leakage where a user or tenant can retrieve checkpoint data belonging to sibling namespaces that share common prefixes in their flattened string representations. This creates a scenario where namespace isolation breaks down, potentially exposing confidential information between different users or organizational units within the same system.
The security implications extend beyond simple data leakage to encompass potential privilege escalation and unauthorized access patterns that violate fundamental security principles of separation of concerns. This vulnerability directly relates to CWE-20, "Improper Input Validation," and CWE-77, "Improper Neutralization of Special Elements Used in a Command," as the system fails to properly sanitize namespace identifiers before using them in database operations. The issue also aligns with ATT&CK technique T1566, "Phishing," in that it represents an indirect means of data exfiltration through legitimate system interfaces, though the attack vector requires existing authentication rather than social engineering.
Organizations using LangGraph checkpoint implementations must immediately upgrade to version 3.1.1 or later to remediate this vulnerability. The fix implemented in these versions addresses the core issue by properly escaping namespace identifiers and implementing more robust namespace scoping mechanisms that prevent prefix-based pattern matching from inadvertently exposing data from related namespaces. System administrators should conduct thorough security assessments of their LangGraph implementations, particularly in multi-tenant deployments where user isolation is paramount. Additionally, monitoring should be implemented to detect any suspicious access patterns that might indicate exploitation attempts, and all users with checkpoint storage access should have their permissions reviewed to ensure appropriate least-privilege principles are maintained throughout the system deployment.