AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution

highnews

security

Source: The Hacker NewsJune 12, 2026

Summary

LangGraph, an open-source framework for building AI agent applications, has three patched security flaws that could allow attackers to execute remote code (run commands on a server they don't own) on self-hosted systems. The most critical flaw is a SQL injection vulnerability (weakness that lets attackers manipulate database queries) in the SQLite checkpoint system that can be chained with an unsafe deserialization vulnerability (flaw in how the system reconstructs data from storage) to gain complete control of affected servers.

Solution / Mitigation

Update to the following patched versions: langgraph-checkpoint-sqlite version 3.0.1 or later (fixes CVE-2025-67644), langgraph version 1.0.10 or later (fixes CVE-2026-28277), and @langchain/langgraph-checkpoint-redis version 1.0.1 or later (fixes CVE-2026-27022). Additionally, the source recommends implementing authentication for self-hosted LangGraph servers, avoiding long-lived static secrets, enforcing network segmentation, treating AI agents as privileged identities, and applying the principle of least privilege (PoLP) to limit the agent's access to only what it needs.