CVE-2026-115883: LangGraph checkpoint savers namespace validation bypass in SQLite and Postgres

CVE-2026-115883 · Severity: medium · CVSS 4 · Published 2026-10-23

LangGraph is a framework for building stateful AI agent applications. When using Postgres or SQLite-backed storage, an attacker who can influence namespace labels in read, delete, or batch operations could bypass namespace isolation and access, modify, or delete another tenant's data. The vulnerability exists because namespaces are joined with dots, so labels containing dots can be misinterpreted as crossing namespace boundaries.

Technologies: langgraph-checkpoint-sqlite (PyPI). Vendors: LangChain, LangChain AI, PyPI.

Quick answers

Is CVE-2026-115883 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115883 being exploited in the wild.
How severe is CVE-2026-115883?
Medium severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?
LangChain Langgraph all versions with PostgresStore, AsyncPostgresStore, SqliteStore, AsyncSqliteStore; LangChain Langgraph-Checkpoint-Postgres before 3.1.3; LangChain Langgraph-Checkpoint-Sqlite before 3.1.2; LangChain AI Langgraph-Checkpoint-Postgres before 3.1.3; and 3 more.
Is there a fix for CVE-2026-115883?
Yes. langgraph-checkpoint-postgres (PyPI): upgrade to 3.1.3 or later; langgraph-checkpoint-sqlite (PyPI): upgrade to 3.1.2 or later. Until then: Validate namespace labels before passing them to store read, delete, or batch operations to ensure they do not contain dots and match expected tenant or user identifiers. Restrict which callers can influence namespace label values, especially in multi-tenant deployments. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115883 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115883?
Check whether you run LangChain Langgraph, LangChain Langgraph-Checkpoint-Postgres, LangChain Langgraph-Checkpoint-Sqlite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langgraph-checkpoint-postgres (PyPI): upgrade to 3.1.3 or later
    pip install "langgraph-checkpoint-postgres>=3.1.3"
  • langgraph-checkpoint-sqlite (PyPI): upgrade to 3.1.2 or later
    pip install "langgraph-checkpoint-sqlite>=3.1.2"

Validate namespace labels before passing them to store read, delete, or batch operations to ensure they do not contain dots and match expected tenant or user identifiers. Restrict which callers can influence namespace label values, especially in multi-tenant deployments.

Technical details

The Postgres and SQLite store implementations join namespace tuples with "." delimiters, so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. While the `put` method rejected labels containing dots, the `get`, `search`, `delete`, `list_namespaces` methods and operations passed to `batch`/`abatch` did not validate namespace labels, allowing an attacker to supply a dotted label to traverse to another namespace. InMemoryStore is unaffected because it compares namespaces as tuples without string joining.

Affected products

  • LangChain langgraph-checkpoint-postgres before 3.1.3
  • LangChain langgraph-checkpoint-sqlite before 3.1.2
  • LangChain langgraph all versions with PostgresStore, AsyncPostgresStore, SqliteStore, AsyncSqliteStore

Identifiers

  • CVE-2026-115883
  • GHSA-6hmw-9432-67qq

Timeline

  • 2026-10-23: disclosed
  • 2026-10-23: advisory: GHSA-6hmw-9432-67qq published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.