Executive brief
LangGraph is a library used to build stateful AI agents. A vulnerability in its MongoDB storage component allows attackers to bypass security boundaries and access data belonging to other users or tenants. This could lead to the exposure of sensitive conversation history, metadata, and pending AI tasks.
Technical details
A NoSQL injection vulnerability exists in the `MongoDBSaver` component of LangGraph. The root cause is a lack of strict type enforcement for checkpoint identifier fields (thread_id, checkpoint_ns, and checkpoint_id) used in MongoDB `find()` queries within `MongoDBSaver.getTuple()`. An attacker can provide malicious object payloads containing MongoDB operators (e.g., `$gt`, `$ne`) instead of literal strings. If these values are passed unvalidated from user input into the graph configuration, the attacker can manipulate the query logic to retrieve checkpoints outside their authorized scope. The issue is fixed in version 1.3.1 by adding runtime validation for these identifiers.
Affected products
- LangChain @langchain/langgraph-checkpoint-mongodb <= 1.3.0
Timeline
- 2026-05-21: disclosed: Initial disclosure in langchain-ai/langgraphjs
- 2026-06-12: advisory: GitHub Advisory published
- 2026-06-12: patched: Version 1.3.1 released with hardening changes
References
- https://api.github.com/users/Nagendhra-web
- https://github.com/Nagendhra-web
- https://api.github.com/users/Nagendhra-web/gists%7B/gist_id%7D
- https://api.github.com/users/Nagendhra-web/repos
- https://avatars.githubusercontent.com/u/219036912?v=4
- https://api.github.com/users/Nagendhra-web/events%7B/privacy%7D