Skip to content
AI Security Wire

Published

- 4 min read

By

New LangGraph CVE Exposes Cross-Tenant AI Agent Data

LangGraph LangChain CVE-2026-55253 NoSQL injection MongoDB AI agents multi-tenancy data exposure
img of New LangGraph CVE Exposes Cross-Tenant AI Agent Data

A high-severity NoSQL injection bug in LangGraph’s MongoDB persistence layer became public on August 20, and it’s the kind of disclosure that ought to worry anyone running multi-tenant AI agents. Tracked as CVE-2026-55253, the flaw sits in the MongoDB checkpoint and store libraries that many teams use to give their LangGraph agents durable, cross-session memory.

What the Bug Actually Does

LangGraph agents rely on a checkpointer to persist state between steps and sessions. The MongoDB backend, split across two packages, langgraph-checkpoint-mongodb and langgraph-store-mongodb, exposes methods called MongoDBSaver.list() and MongoDBStore.search() for querying that stored state. Both accept a filter parameter, and both pass it into the underlying MongoDB query without stripping out operator keys first.

That matters because MongoDB treats any key starting with a dollar sign as a query operator rather than a literal value to match against. Feed it $ne, $gt, or $where inside a filter object, and the database will happily execute it as an instruction instead of comparing it as data. If an attacker controls any part of that filter, whether directly through an API parameter or indirectly through some upstream input that ends up folded into it, they can rewrite the query’s scope entirely.

In a typical agent deployment, this filter is what keeps one user’s conversation thread separate from another’s. Widen it, and an agent session that should only see its own checkpoint history can instead pull records that belong to a different tenant. The GitLab Advisory Database classifies this as CWE-943, improper neutralization of special elements used in a data query, and rates it High severity with a CVSS score of 7.7. GitHub’s own advisory, GHSA-533j-2v4q-mw5h, agrees with that High rating.

Who’s Exposed

Every version of langgraph-checkpoint-mongodb before 0.3.0 and langgraph-store-mongodb before 0.4.0 carries the flaw. Anyone running LangGraph agents against a MongoDB checkpoint store, and there are plenty, given how common Mongo is as an operational data store for teams already running document-based infrastructure, needs to check their pinned versions now. Credit for the discovery goes to a researcher listed as kenichikawaguchi in the advisory records.

The practical risk scales with how the application exposes the filter parameter. A tightly scoped internal agent that never lets user input reach MongoDBSaver.list() is lower risk. A multi-tenant SaaS product that lets end users query their own thread history, and quietly reuses that same code path under the hood, is exactly the shape of application this bug was built to break.

Part of a Pattern, Not an Isolated Incident

This isn’t the first time LangGraph’s persistence layer has drawn scrutiny. Check Point Research published a separate disclosure in June covering a SQLite and Redis checkpointer chain, CVE-2025-67644, CVE-2026-27022, and CVE-2026-28277, that escalated a SQL injection bug into full remote code execution on the agent server. And this isn’t even the first MongoDB-specific bug in this component family. CVE-2026-48121, patched back in June, covered an earlier NoSQL injection issue in the same checkpoint package.

Taken together, the pattern is hard to miss. As agent frameworks like LangGraph become the default plumbing for stateful, multi-step AI systems, with LangGraph’s checkpointer components alone seeing tens of millions of monthly downloads, the query layer that manages agent memory keeps turning up unsanitized input paths. It’s a different failure mode than prompt injection or jailbreaking, and one that gets a lot less attention, but the consequence, one tenant’s data leaking into another’s agent session, is just as serious for any team running agents on behalf of multiple customers.

What to Do About It

Upgrade to langgraph-checkpoint-mongodb 0.3.0 or later and langgraph-store-mongodb 0.4.0 or later immediately. If an upgrade isn’t possible right away, audit every code path that calls MongoDBSaver.list() or MongoDBStore.search() and confirm that filter values are never built from user-controlled input without sanitization. For multi-tenant deployments specifically, treat this as a reminder to verify tenant isolation at the application layer too, rather than trusting the persistence backend alone to enforce it.

References

Frequently Asked Questions

What is CVE-2026-55253?
It's a high-severity NoSQL operator injection vulnerability disclosed August 20, 2026, in langgraph-checkpoint-mongodb and langgraph-store-mongodb, the MongoDB persistence backends for LangChain's LangGraph agent framework. The MongoDBSaver.list() and MongoDBStore.search() methods pass an unsanitized filter parameter straight into MongoDB queries, letting an attacker smuggle in operators like $ne or $where to widen a query beyond its intended scope.
Who is affected and what should teams do?
Any application using langgraph-checkpoint-mongodb or langgraph-store-mongodb before the patched versions (0.3.0 and 0.4.0 respectively) is affected, particularly multi-tenant platforms that scope agent memory by thread or session ID. Teams should upgrade immediately and audit whether filter values passed to MongoDBSaver.list() or MongoDBStore.search() ever originate from user-controlled input.
Is this related to the earlier LangGraph RCE chain from June 2026?
It's a related but distinct issue. Check Point Research's June 2026 disclosure covered a SQLite and Redis checkpointer chain, CVE-2025-67644, CVE-2026-27022, and CVE-2026-28277, that escalated to remote code execution. CVE-2026-55253 hits the MongoDB backend instead and results in cross-tenant data exposure rather than RCE, but it points to the same underlying pattern: LangGraph's persistence layer keeps surfacing query-injection risk across every backend it supports.