CVE-2026-28277: LangChain LangGraph unsafe msgpack deserialization in checkpointers

CVE-2026-28277 · Severity: medium · CVSS 6.8 · Published 2026-03-05

LangGraph, a library for building stateful multi-agent applications, is vulnerable to unsafe data processing when loading saved application states (checkpoints). If an attacker gains access to the database or storage where these states are kept, they can insert malicious data that executes unauthorized code when the application resumes. This could allow an attacker who has already breached a storage system to further compromise the application server and access sensitive credentials or environment variables.

Technologies: langgraph (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-28277 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28277 being exploited in the wild.
How severe is CVE-2026-28277?
Medium severity, with a CVSS score of 6.8, published 5 March 2026.
Which products and versions are affected?
langgraph (PyPI) <= 1.0.9, ECOSYSTEM:introduced=0,fixed=1.0.10, ECOSYSTEM:introduced=0,fixed=1.0.10rc1.
Is there a fix for CVE-2026-28277?
Yes. langgraph (PyPI): upgrade to 1.0.10, 1.0.10rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28277 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-28277?
Check whether you run langgraph (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langgraph (PyPI): upgrade to 1.0.10, 1.0.10rc1 or later
    pip install "langgraph>=1.0.10rc1"

Technical details

LangGraph checkpointers utilize msgpack for serializing and deserializing state checkpoints. The deserialization process was found to be unsafe because it could reconstruct arbitrary Python objects from 'ext' types without sufficient validation. An attacker with privileged write access to the persistence layer (e.g., database, shared filesystem) can inject a crafted msgpack payload. When the application loads this checkpoint, the unsafe reconstruction triggers arbitrary code execution. This is considered a defense-in-depth issue as it requires prior access to the storage backend. The fix, introduced in version 1.0.10, implements an allowlist-based hardening mechanism and a strict mode via the LANGGRAPH_STRICT_MSGPACK environment variable.

Affected products

  • langchain-ai langgraph <= 1.0.9

Identifiers

  • CVE-2026-28277
  • GHSA-g48c-2wqr-h844
  • PYSEC-2026-83

Timeline

  • 2026-03-05: disclosed
  • 2026-03-05: advisory
  • 2026-03-05: patched: Fixed in version 1.0.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.