Vulnerability-Lookup

GHSA-6HMW-9432-67QQ

Vulnerability from github – Published: 2026-10-23 22:06 – Updated: 2026-10-23 22:06

Summary

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Details

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Severity

6.0 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-checkpoint-postgres"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-checkpoint-sqlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-115883"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-23T22:06:44Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Postgres and SQLite stores save a namespace as its labels joined with `.`, so `(\"tenant\", \"bob\")` and `(\"tenant.bob\",)` map to the same stored namespace. `put` rejected labels containing `.`, but `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed directly to `batch`/`abatch` did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.\n\n### Details\n\n`BaseStore` checked namespace labels only in `put`/`aput`. The other methods passed the namespace on unchecked, and `batch`/`abatch` checked nothing, including the `PutOp` items inside them. `PostgresStore`, `AsyncPostgresStore`, `SqliteStore` and `AsyncSqliteStore` turn a namespace into text with `\".\".join(namespace)`, so a label containing `.` resolved to the namespace whose labels it spells out:\n\n- `get((\"tenant.bob\",), key)`, `search((\"tenant.bob\",))` and `list_namespaces(prefix=(\"tenant.bob\",))` returned data stored under `(\"tenant\", \"bob\")`.\n- `delete((\"tenant.alice\",), key)` deleted the item stored under `(\"tenant\", \"alice\")`.\n- `batch([PutOp((\"tenant.bob\",), key, value)])` overwrote the item stored under `(\"tenant\", \"bob\")`.\n\nAll releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected. `InMemoryStore` compares namespaces as tuples and is not affected.\n\n### Impact\n\nYou may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or `batch` call. Such input could read, overwrite or delete another tenant\u0027s items. Labels written through `put` could never contain `.`, so no stored data becomes unreachable after upgrading.\n\nLangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.\n\n### Remediation\n\nUpgrade to `langgraph-checkpoint-postgres` 3.1.3 or `langgraph-checkpoint-sqlite` 3.1.2. Both require `langgraph-checkpoint` 4.3.0, where `get`, `search`, `delete` and `list_namespaces` reject labels that are empty, are not strings, or contain `.` with `InvalidNamespaceError`, and the Postgres and SQLite stores apply the same check to every op passed to `batch`/`abatch`. Stores outside this repository that turn namespaces into delimited text can call `langgraph.store.base.validate_op_namespace` for each op they run.",
  "id": "GHSA-6hmw-9432-67qq",
  "modified": "2026-10-23T22:06:44Z",
  "published": "2026-10-23T22:06:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/pull/9217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/commit/bfcfea554ed5c7f7be562cebf8825e911b493ab1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langgraph"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores"
}

CVE-2026-115883 (GCVE-0-2026-115883)

Vulnerability from cvelistv5 – Published: 2026-10-23 21:12 – Updated: 2026-10-26 17:42

Title

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Summary

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples. This issue is fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 15:39 UTC

CWE

CWE-20 - Improper Input Validation
CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7797 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/langchain-ai/langgraph/securit…	x_refsource_CONFIRM
https://github.com/langchain-ai/langgraph/pull/9217	x_refsource_MISC
https://github.com/langchain-ai/langgraph/commit/…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
langchain-ai	langgraph	Affected: < 1.2.15
langchain-ai	langgraph-checkpoint-postgres	Affected: < 3.1.3
langchain-ai	langgraph-checkpoint-sqlite	Affected: < 3.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115883",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:39:07.446530Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:42:32.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langgraph",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.15"
            }
          ]
        },
        {
          "product": "langgraph-checkpoint-postgres",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.3"
            }
          ]
        },
        {
          "product": "langgraph-checkpoint-sqlite",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with \".\".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant\u0027s stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples. This issue is fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T21:12:34.523Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq"
        },
        {
          "name": "https://github.com/langchain-ai/langgraph/pull/9217",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/langgraph/pull/9217"
        },
        {
          "name": "https://github.com/langchain-ai/langgraph/commit/bfcfea554ed5c7f7be562cebf8825e911b493ab1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/langgraph/commit/bfcfea554ed5c7f7be562cebf8825e911b493ab1"
        }
      ],
      "source": {
        "advisory": "GHSA-6hmw-9432-67qq",
        "discovery": "UNKNOWN"
      },
      "title": "LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115883",
    "datePublished": "2026-10-23T21:12:34.523Z",
    "dateReserved": "2026-10-23T19:37:27.176Z",
    "dateUpdated": "2026-10-26T17:42:32.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-6HMW-9432-67QQ

Summary

Details

Impact

Remediation

CVE-2026-115883 (GCVE-0-2026-115883)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour