{"data":{"id":"02199e3e-19a9-45b1-b222-e2b948b481ed","title":"GHSA-47pj-3jcm-6whg: LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores","summary":"The Postgres and SQLite stores in LangGraph matched scoped namespace reads with LIKE on a dot-joined string, so a scoped search or list_namespaces could also return items from sibling namespaces that share leading characters, such as foo and foobar. Namespace labels containing _ or % were also interpreted as pattern metacharacters, letting user_1 match userX1, and the list_namespaces suffix condition could match sibling leaves like users.malice. The flaw is a confidentiality issue in read paths only where namespaces serve as a tenant or user boundary, and the source reports no evidence of exploitation in the wild.","solution":"Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1. Callers relying on multi-segment * matching in list_namespaces can express it by combining prefix and suffix conditions, for example list_namespaces(prefix=[\"uid\"], suffix=[\"alice\"]). The source also recommends fixed-length namespace labels such as UUIDs and validating user-supplied labels at the boundary.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-47pj-3jcm-6whg","publishedAt":"2026-08-06T19:03:12.000Z","cveId":"CVE-2026-71433","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langgraph-checkpoint-sqlite@< 3.1.1 (fixed: 3.1.1)","langgraph-checkpoint-postgres@< 3.1.1 (fixed: 3.1.1)"],"affectedPackageNames":["langgraph-checkpoint-sqlite","langgraph-checkpoint-postgres"],"affectedPackageRefs":["pypi:langgraph-checkpoint-postgres","pypi:langgraph-checkpoint-sqlite"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangGraph","langgraph-checkpoint-postgres","langgraph-checkpoint-sqlite","LangSmith"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00363,"epssCheckedAt":"2026-11-04T18:09:12.821Z","kevDateAdded":null,"advisoryAliases":["GHSA-47pj-3jcm-6whg"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-06T19:03:12.000Z","fixReleasedAt":"2026-07-30T19:15:37.405Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:32:06.362Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langgraph-checkpoint-sqlite","fixedVersion":"3.1.1","matchedVersion":"3.1.1","fixReleasedAt":"2026-07-30T19:19:36.424Z","daysToFix":-7,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:06.215Z"},{"ecosystem":"pypi","name":"langgraph-checkpoint-postgres","fixedVersion":"3.1.1","matchedVersion":"3.1.1","fixReleasedAt":"2026-07-30T19:15:37.405Z","daysToFix":-7,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:06.215Z"}]}}