langchain-ai langgraph up to 1.0.9 SQLite Checkpoint deserialization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in langchain-ai langgraph up to 1.0.9. The affected element is an unknown function of the component SQLite Checkpoint. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2026-28277. Access to the local network is required for this attack. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in langchain-ai langgraph up to 1.0.9. This affects an unknown functionality of the component SQLite Checkpoint. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-28277 since 02/26/2026. The exploitability is told to be easy. The attack can only be done within the local network. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/07/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-9860) and CERT Bund (WID-SEC-2026-1407). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• IBM App Connect Enterprise

Productinfo

Type

• Artificial Intelligence Software

Vendor

• langchain-ai

Name

• langgraph

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9

Website

• Product: https://github.com/langchain-ai/langgraph/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion