LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-863.
Summary
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a sibling namespace whose flattened form shares the same leading characters, or a namespace label containing unescaped pattern metacharacters, allowing an authenticated caller to retrieve stored items belonging to another tenant or user through an ordinary scoped search or list namespaces call, with no crafted input required. This issue is fixed in versions 3.1.1 of langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langchain-ai | langgraph | before 3.1.1 | 3.1.1 | Patch available | CNA |
| langchain-ai | langgraph-checkpoint-sqlite | before 3.1.1 | 3.1.1 | Patch available | CNA |
| langchain-ai | langgraph-checkpoint-postgres | before 3.1.1 | 3.1.1 | Patch available | CNA |
| — | langgraph-checkpoint-postgres (PyPI) | before 3.1.1 | 3.1.1 | Patch available | GHSA-47pj-3jcm-6whg |
| — | langgraph-checkpoint-sqlite (PyPI) | before 3.1.1 | 3.1.1 | Patch available | GHSA-47pj-3jcm-6whg |
- langgraph Vendorlangchain-ai Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- langgraph-checkpoint-sqlite Vendorlangchain-ai Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- langgraph-checkpoint-postgres Vendorlangchain-ai Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- langgraph-checkpoint-postgres (PyPI) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-47pj-3jcm-6whg
- langgraph-checkpoint-sqlite (PyPI) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-47pj-3jcm-6whg
Remediation
- Fix · CNA langgraph (langchain-ai) Fixed in 3.1.1
- Fix · CNA langgraph-checkpoint-sqlite (langchain-ai) Fixed in 3.1.1
- Fix · CNA langgraph-checkpoint-postgres (langchain-ai) Fixed in 3.1.1
- Fix · GHSA-47pj-3jcm-6whg langgraph-checkpoint-postgres (PyPI) Fixed in 3.1.1 Advisory →
- Fix · GHSA-47pj-3jcm-6whg langgraph-checkpoint-sqlite (PyPI) Fixed in 3.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71433
- 2026-10-03 Alias added: GHSA-47pj-3jcm-6whg
References
Other 6
- https://github.com/langchain-ai/langgraph/security/advisories/GHSA-47pj-3jcm-6whg
- https://github.com/langchain-ai/langgraph/pull/8478
- https://github.com/langchain-ai/langgraph/commit/66ebe1a0da921e73f0f9f879ba105d314c079f7c
- https://github.com/langchain-ai/langgraph/releases/tag/checkpointpostgres%3D%3D3.1.1
- https://github.com/langchain-ai/langgraph/releases/tag/checkpointsqlite%3D%3D3.1.1
- https://github.com/langchain-ai/langgraph
More langchain-ai vulnerabilities
- TI-2024-31340 langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain… CVSS 3.1CRITICAL 9.8
- TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
- TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
- TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-71433 · CVE Program
- CVE-2026-71433 · NVD
- FIRST EPSS
- GHSA-47pj-3jcm-6whg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences