{
  "affected": [
    {
      "affectedData": [
        {
          "product": "langgraph",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.1"
            }
          ]
        },
        {
          "product": "langgraph-checkpoint-sqlite",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.1"
            }
          ]
        },
        {
          "product": "langgraph-checkpoint-postgres",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.1.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph\u0027s checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a sibling namespace whose flattened form shares the same leading characters, or a namespace label containing unescaped pattern metacharacters, allowing an authenticated caller to retrieve stored items belonging to another tenant or user through an ordinary scoped search or list namespaces call, with no crafted input required. This issue is fixed in versions 3.1.1 of langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite."
    }
  ],
  "id": "CVE-2026-71433",
  "lastModified": "2026-08-07T15:17:03.857",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-71433",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T14:51:21.131061Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:18:30.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/langchain-ai/langgraph/commit/66ebe1a0da921e73f0f9f879ba105d314c079f7c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/langchain-ai/langgraph/pull/8478"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-47pj-3jcm-6whg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-checkpoint-postgres"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langgraph-checkpoint-sqlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-71433"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T19:03:12Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (`(\"memories\", \"alice\")` becomes `memories.alice`) and scoped reads by matching that string with `LIKE \u0027\u003cpath\u003e%\u0027`. Because `LIKE` has no notion of the `.` separator, a scoped `search` or `list_namespaces` also matched sibling namespaces whose flattened form shares leading characters.\n\nApplications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input \u2014 an ordinary scoped request was sufficient.\n\nWe have no evidence of this behavior being exploited in the wild.\n\n## Affected users / systems\n\nYou may be affected if you:\n\n- use `PostgresStore`/`AsyncPostgresStore` or `SqliteStore`/`AsyncSqliteStore`, and\n- rely on the namespace to separate data between users or tenants, and\n- have namespace labels where one is a prefix of another (`1` and `12`, `alice` and `alice2`), or labels containing `_` or `%`\n\nApplications whose namespace labels are fixed-length identifiers such as UUIDs, containing no `_` or `%`, are not affected \u2014 no such label can be a prefix of another. `InMemoryStore` compares namespaces element-wise and is not affected.\n\nThree distinct cases were possible:\n\n- **Sibling namespaces.** A read scoped to `(\"foo\",)` also returned items under `(\"foobar\",)` and `(\"foo2\",)`.\n- **Unescaped pattern metacharacters.** `_` and `%` are legal namespace labels \u2014 only `.` is rejected \u2014 but were interpolated into the match pattern unescaped, so `(\"user_1\",)` also matched `(\"userX1\",)`.\n- **Suffix conditions.** `list_namespaces(suffix=(\"alice\",))` also matched the sibling leaf `users.malice`.\n\nThis is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value *was itself* a `LIKE` pattern whose metacharacters were not neutralized.\n\n## Impact\n\n- Confidentiality: disclosure of stored items belonging to namespaces outside the caller\u0027s intended scope, where namespaces are used as a tenant or user boundary.\n- No integrity or availability impact. `get`, `put`, and `delete` compare namespaces with `=` and were never affected; the issue is limited to read paths.\n\n## Patches / mitigation\n\nPrefix scoping now matches the namespace exactly or requires the `.` separator before any remainder, pattern metacharacters in labels are escaped, and `list_namespaces` uses segment-aware matching for both prefix and suffix conditions.\n\nOn SQLite, the descendant match moved from `LIKE` to `GLOB`. `LIKE` is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while `get`/`put`/`delete` treated them as distinct. Search now agrees with them.\n\nUpgrade to `langgraph-checkpoint-postgres` 3.1.1 or `langgraph-checkpoint-sqlite` 3.1.1.\n\n## Compatibility\n\n`*` in a `list_namespaces` match path now spans exactly one namespace segment. This restores the documented behavior \u2014 `NamespacePath` documents `(\"cache\", \"*\", \"v1\")` as \"any cache category with v1 version\" \u2014 and matches `InMemoryStore`. Multi-segment matching was an artifact of translating `*` into a SQL `%` wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.\n\nCallers relying on the previous behavior can express \"match at any depth\" by combining both match conditions, which are ANDed:\n\n```python\nlist_namespaces(prefix=[\"uid\"], suffix=[\"alice\"])\n```\n\nApplications whose namespace labels cannot be prefixes of one another see no behavioral change.\n\n## Operational guidance\n\n- Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.\n- Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.\n\n## LangSmith / hosted deployments note\n\nUnlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to `LANGGRAPH_STORE_BACKEND=python`, which uses `AsyncPostgresStore` from `checkpoint-postgres`. Deployments configured with `LANGGRAPH_STORE_BACKEND=grpc` use a separate implementation that received an equivalent fix.",
  "id": "GHSA-47pj-3jcm-6whg",
  "modified": "2026-08-06T19:03:12Z",
  "published": "2026-08-06T19:03:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-47pj-3jcm-6whg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/pull/8478"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/commit/66ebe1a0da921e73f0f9f879ba105d314c079f7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langgraph"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores"
}