Security researchers at Check Point have detailed three vulnerabilities in LangGraph, the open-source framework from LangChain for building stateful, multi-agent AI applications. Two of them chain together into a remote code execution (RCE) exploit for self-hosted deployments. LangChain’s managed LangSmith platform is not affected.
The core issue is a SQL injection in the SQLite checkpoint store (CVE-2025-67644, CVSS 7.3). An attacker can inject malicious filter keys into metadata queries, rewriting what the system retrieves from the database. That alone lets them inject a crafted, serialized blob into the checkpoint column.
That blob is the second vulnerability (CVE-2026-28277, CVSS 6.8): an unsafe msgpack deserialization. When the application loads a checkpoint, it blindly reconstructs objects from the blob. An attacker who can modify checkpoint data—achieved here via the SQLi—can execute arbitrary code on the server. The chain requires the `get_state_history()` endpoint to be exposed, which is common in agentic workflows that need to replay or inspect past states.
The third flaw (CVE-2026-27022, CVSS 6.5) is a RediSearch query injection in the Redis checkpoint adapter that can bypass access controls.
From an architectural standpoint, this is a textbook example of how classic injection vulnerabilities become more dangerous when they hit the persistence layer of an AI agent framework. Agents often run with elevated trust—access to runtime secrets, internal networks, and other systems. An attacker who gets code execution on the checkpoint store escalates from data tampering to full host compromise.
Mitigations are straightforward: patch to langgraph-checkpoint-sqlite >= 3.0.1, langgraph >= 1.0.10, and @langchain/langgraph-checkpoint-redis >= 1.0.1. For self-hosted setups, add authentication to the agent server, segment the network so the checkpoint store isn’t reachable from untrusted clients, and treat the agent runtime as a privileged identity—apply least privilege to what it can access. Avoid long-lived static secrets; rotate them regularly.
Source: The Hackers News