GHSA-98xf-r82g-9mhx: LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access

Summary

LangGraph's `MongoDBSaver` in `@langchain/langgraph-checkpoint-mongodb` used `thread_id`, `checkpoint_ns` and `checkpoint_id` from `config.configurable` in MongoDB `find()` queries without strict type checks. Attacker-supplied operator objects such as `$gt` and `$ne` could be treated as query operators, letting them return checkpoints from other tenants, including state, metadata and pending writes.

Mitigation

Fixed in @langchain/langgraph-checkpoint-mongodb 1.3.1, which adds runtime validation for configurable checkpoint identifiers and rejects invalid values before query and write paths run. Upgrade to 1.3.1 or later. Validate identifier fields at API boundaries and avoid passing raw client objects into graph config.

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database