| Component | LangGraph |
| Severity | medium (CVSS 6.8) |
| CVSS vector | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published (NVD) | 2026-03-05 |
| Last modified | 2026-06-17 |
| Affected versions | langgraph <= 1.0.9 |
| Fixed in | see the vendor advisory |
| Weakness | CWE-502 |
| CISA KEV | not listed |
NVD description
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded. No known patch is public.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep LangGraph off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-28277
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-g48c-2wqr-h844
Other LangGraph CVEs
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python application...
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorize...
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specif...
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la...
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3....
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0...