LangGraph’s checkpoint storage for Postgres and SQLite persisted hierarchical namespaces as a single dot‑joined string and performed scoped reads by simple prefix matching. Before version 3.1.1, this matching algorithm allowed a user to query a namespace that shared a common leading fragment of the string, causing the application to return items belonging to a different tenant or user. The flaw does not require crafted input; any authenticated caller who can invoke the normal list or get operations can obtain data from another namespace, resulting in confidentiality exposure.

Vendors and products affected are langchain-ai’s LangGraph core (langgraph) and its Postgres and SQLite checkpoint implementations (langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite). The vulnerability exists in all releases before 3.1.1 of each package. Version 3.1.1 and later contain the patch that properly scopes namespace reads.

The CVSS score of 5.3 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploits are publicly documented. The flaw is exploitable by any authenticated user who can call the checkpoint API, meaning that the attack surface is limited to systems that expose the checkpoint service. An attacker would gain read access to data that should be isolated to another tenant, which could lead to data leakage and potential regulatory violations. Therefore, the risk is moderate but requires immediate mitigation to prevent potentially sensitive information from being exposed.