CVE-2026-48121: LangChain LangGraph NoSQL injection in MongoDBSaver

CVE-2026-48121 · Severity: medium · CVSS 6.7 · Published 2026-08-04

LangGraph is a library used to build stateful AI agents. A vulnerability in its MongoDB storage component allows attackers to bypass security boundaries and access data belonging to other users or tenants. This could lead to the exposure of sensitive conversation history, metadata, and pending AI tasks.

Vendors: LangChain, npm.

Quick answers

Is CVE-2026-48121 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48121 being exploited in the wild.
How severe is CVE-2026-48121?
Medium severity, with a CVSS score of 6.7, published 4 August 2026.
Which products and versions are affected?
@langchain/langgraph-checkpoint-mongodb (npm) <= 1.3.0, SEMVER:introduced=0,fixed=1.3.1.
Is there a fix for CVE-2026-48121?
Yes. @langchain/langgraph-checkpoint-mongodb (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48121 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48121?
Check whether you run LangChain LangGraph Checkpoint MongoDB or @langchain/langgraph-checkpoint-mongodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @langchain/langgraph-checkpoint-mongodb (npm): upgrade to 1.3.1 or later
    npm install @langchain/langgraph-checkpoint-mongodb@1.3.1

Technical details

A NoSQL injection vulnerability exists in the `MongoDBSaver` component of LangGraph. The root cause is a lack of strict type enforcement for checkpoint identifier fields (thread_id, checkpoint_ns, and checkpoint_id) used in MongoDB `find()` queries within `MongoDBSaver.getTuple()`. An attacker can provide malicious object payloads containing MongoDB operators (e.g., `$gt`, `$ne`) instead of literal strings. If these values are passed unvalidated from user input into the graph configuration, the attacker can manipulate the query logic to retrieve checkpoints outside their authorized scope. The issue is fixed in version 1.3.1 by adding runtime validation for these identifiers.

Affected products

  • LangChain @langchain/langgraph-checkpoint-mongodb <= 1.3.0

Identifiers

  • CVE-2026-48121
  • GHSA-98xf-r82g-9mhx

Timeline

  • 2026-05-21: disclosed: Initial disclosure in langchain-ai/langgraphjs
  • 2026-06-12: advisory: GitHub Advisory published
  • 2026-06-12: patched: Version 1.3.1 released with hardening changes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.