Skip to content
AI Sec Watch
MediumVulnerability

GHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-115883GHSA-6hmw-9432-67qq
Published
Record updated
View JSON
Affected
  • langgraph-checkpoint-sqlite < 3.1.2, fixed in 3.1.2
  • langgraph-checkpoint-postgres < 3.1.3, fixed in 3.1.3
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.

Summary

The Postgres and SQLite stores in LangGraph joined namespace labels with `.`, so a label containing a dot, such as `("tenant.bob",)`, mapped to the same stored namespace as `("tenant", "bob")`. Although `put` rejected such labels, `get`, `search`, `delete`, `list_namespaces`, their async versions, and ops passed to `batch`/`abatch` did not, letting a caller read, overwrite or delete items in another namespace. All releases of `langgraph-checkpoint-postgres` before 3.1.3 and `langgraph-checkpoint-sqlite` before 3.1.2 are affected, while `InMemoryStore` is not.

Mitigation

Upgrade to `langgraph-checkpoint-postgres` 3.1.3 or `langgraph-checkpoint-sqlite` 3.1.2, which require `langgraph-checkpoint` 4.3.0. Stores outside this repository that turn namespaces into delimited text can call `langgraph.store.base.validate_op_namespace` for each op they run.

Related items