AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-47pj-3jcm-6whg: LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

mediumvulnerability

security

Source: GitHub Advisory DatabaseAugust 6, 2026CVE-2026-71433

Summary

LangGraph's Postgres and SQLite stores had a bug where namespace scoping (a feature that separates data between users or tenants) didn't properly respect boundaries because it used a string-matching function called LIKE that doesn't understand the dot separator used in namespace paths. This meant a request for data from namespace "alice" could accidentally return data from "alice2" or "alice_user" without any special attack needed. The bug only affects applications where namespace labels could share prefixes, like "1" and "12", or contain underscore characters.

Solution / Mitigation

Upgrade to langgraph-checkpoint-postgres version 3.1.1 or langgraph-checkpoint-sqlite version 3.1.1. The fix changes how prefix scoping works to require the dot separator before any remainder, escapes special characters in namespace labels, and uses segment-aware matching for both prefix and suffix conditions. On SQLite specifically, the code switched from using LIKE to using GLOB for matching descendant namespaces.