Junglewise Threat Intelligence

CVE-2026-71433: LangGraph incorrect authorization in Postgres and SQLite namespace matching

CVE-2026-71433 · Severity: medium · CVSS 5.3 · Published 2026-08-06

Executive brief

LangGraph is a library used to build stateful AI agents. A flaw in how it handles data storage in Postgres and SQLite databases could allow one user or tenant to see data belonging to another if their identifiers share similar names (e.g., 'user1' seeing data for 'user12'). This could lead to unauthorized access to sensitive conversation history or agent memory in multi-tenant applications.

Technical details

The Postgres and SQLite store implementations in LangGraph persist hierarchical namespaces as dot-joined strings (e.g., 'memories.alice'). Scoped read operations like 'search' and 'list_namespaces' used SQL 'LIKE' patterns (e.g., 'path%') for matching. Because 'LIKE' does not recognize the dot separator, a query for 'foo' would incorrectly match 'foobar' or 'foo2'. Additionally, the implementation failed to escape SQL metacharacters like '_' and '%', allowing them to act as wildcards. This results in an authorization bypass where a user scoped to one namespace can retrieve items from another. The issue is fixed in version 3.1.1 by implementing segment-aware matching and proper character escaping.

Affected products

  • LangChain AI langgraph-checkpoint-postgres < 3.1.1
  • LangChain AI langgraph-checkpoint-sqlite < 3.1.1

Timeline

  • 2026-07-30: patched: Fix merged into main branch
  • 2026-08-06: advisory: GitHub Advisory published

References