LangChain’s MongoDB checkpoint saver accepts untrusted configuration values for thread and checkpoint identifiers without type enforcement. If an attacker supplies an object that contains MongoDB query operators such as $gt or $ne, the query is interpreted as a NoSQL operator, bypassing the intended tenant isolation and allowing enumeration and retrieval of checkpoints from other users. The impact is data theft and leakage of pending writes across tenants, compromising confidentiality and potentially data integrity.

The vulnerability affects the @langchain/langgraph-checkpoint-mongodb component of the langgraphjs library from langchain-ai. Versions 1.3.0 and older are susceptible; community and production deployments using those releases are impacted.

The CVSS score of 6.7 indicates moderate severity. EPSS is unavailable, so exploitation likelihood is unknown, and the issue is not listed in CISA KeV. Attackers can exploit the flaw by supplying crafted configuration values in a multi‑tenant or user‑isolated environment, where input is forwarded without coercion to string or validation. If an application uses only server‑issued, validated string identifiers, it remains safe.