Technical impact
LangGraph checkpoint savers for Postgres and SQLite flatten namespace labels by joining tuple elements with a period and validate labels only for put operations. Unvalidated dotted labels supplied to get, search, delete, list_namespaces or batch operations can resolve to another tenant’s stored namespace, letting an attacker read, overwrite or delete data belonging to other namespaces, thereby compromising confidentiality and integrity. The in‑memory store is unaffected because it compares tuples directly.
Affected Systems
The vulnerability affects langchain‑ai LangGraph and its checkpoint stores for Postgres prior to 3.1.3 and for SQLite prior to 3.1.2. Any deployment of LangGraph using these libraries without the specified minimum versions is considered impacted.
Risk and Exploitability
The CVSS score of 6 indicates moderate severity, and the EPSS score is not available, suggesting no current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to supply an arbitrary namespace string to the store operations, which is typically possible through the public API of LangGraph or any application that allows dynamic namespace configuration. The attack could be performed locally within the same process or remotely if the application exposes the vulnerable API to untrusted clients, resulting in cross‑namespace data compromise.
Github GHSA