# CVE-2026-115883: LangGraph checkpoint savers namespace validation bypass in SQLite and Postgres

Source: https://junglewise.ai/threats/cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115883 · Severity: medium · CVSS 4 · Published 2026-10-23

LangGraph is a framework for building stateful AI agent applications. When using Postgres or SQLite-backed storage, an attacker who can influence namespace labels in read, delete, or batch operations could bypass namespace isolation and access, modify, or delete another tenant's data. The vulnerability exists because namespaces are joined with dots, so labels containing dots can be misinterpreted as crossing namespace boundaries.

Technologies: [langgraph-checkpoint-sqlite (PyPI)](https://junglewise.ai/threats/technologies/langgraph-checkpoint-sqlite). Vendors: [LangChain](https://junglewise.ai/threats/vendors/langchain), [LangChain AI](https://junglewise.ai/threats/vendors/langchain-ai), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-115883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115883 being exploited in the wild.

**How severe is CVE-2026-115883?** Medium severity, with a CVSS score of 4, published 23 October 2026.

**Which products and versions are affected?** LangChain Langgraph all versions with PostgresStore, AsyncPostgresStore, SqliteStore, AsyncSqliteStore; LangChain Langgraph-Checkpoint-Postgres before 3.1.3; LangChain Langgraph-Checkpoint-Sqlite before 3.1.2; LangChain AI Langgraph-Checkpoint-Postgres before 3.1.3; and 3 more.

**Is there a fix for CVE-2026-115883?** Yes. langgraph-checkpoint-postgres (PyPI): upgrade to 3.1.3 or later; langgraph-checkpoint-sqlite (PyPI): upgrade to 3.1.2 or later. Until then: Validate namespace labels before passing them to store read, delete, or batch operations to ensure they do not contain dots and match expected tenant or user identifiers. Restrict which callers can influence namespace label values, especially in multi-tenant deployments. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115883 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115883?** Check whether you run LangChain Langgraph, LangChain Langgraph-Checkpoint-Postgres, LangChain Langgraph-Checkpoint-Sqlite or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langgraph-checkpoint-postgres (PyPI): upgrade to 3.1.3 or later

  ```sh
  pip install "langgraph-checkpoint-postgres>=3.1.3"
  ```

- langgraph-checkpoint-sqlite (PyPI): upgrade to 3.1.2 or later

  ```sh
  pip install "langgraph-checkpoint-sqlite>=3.1.2"
  ```


Validate namespace labels before passing them to store read, delete, or batch operations to ensure they do not contain dots and match expected tenant or user identifiers. Restrict which callers can influence namespace label values, especially in multi-tenant deployments.

## Technical details

The Postgres and SQLite store implementations join namespace tuples with "." delimiters, so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. While the `put` method rejected labels containing dots, the `get`, `search`, `delete`, `list_namespaces` methods and operations passed to `batch`/`abatch` did not validate namespace labels, allowing an attacker to supply a dotted label to traverse to another namespace. InMemoryStore is unaffected because it compares namespaces as tuples without string joining.

## Affected products

- LangChain langgraph-checkpoint-postgres before 3.1.3
- LangChain langgraph-checkpoint-sqlite before 3.1.2
- LangChain langgraph all versions with PostgresStore, AsyncPostgresStore, SqliteStore, AsyncSqliteStore

## Identifiers

- CVE-2026-115883
- GHSA-6hmw-9432-67qq

## Timeline

- 2026-10-23: disclosed
- 2026-10-23: advisory: GHSA-6hmw-9432-67qq published

## Related threats

- [LangChain LangGraph path traversal in RemoteGraph streaming](https://junglewise.ai/threats/cve-2026-118667-langgraph-python-sdk-is-used-to-connect-to-running-langgraph-api)
- [LangGraph incorrect authorization in Postgres and SQLite namespace matching](https://junglewise.ai/threats/cve-2026-71433-langgraph-incorrect-authorization-in-postgres-and-sqlite)
- [PYSEC-2026-1530 - LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQLite checkpointer list method](https://junglewise.ai/threats/cve-2025-67644-langgraph-s-sqlite-is-vulnerable-to-sql-injection-via-metadata)
- [LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore](https://junglewise.ai/threats/cve-2025-64104-langgraph-sqlite-checkpoint-filter-key-sql-injection-poc-for)
- [A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation.](https://junglewise.ai/threats/cve-2025-8709-langgraph-s-sqlite-store-implementation-has-a-sql-injection)