LangGraph MongoDB CVE-2026-55253
HIGH
GHSA-533j-2v4q-mw5h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated low-privilege API access required (PR:L); scope changes because injection escapes tenant boundary (S:C); only confidentiality impact applies (read-only).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
---
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
---
Affected Packages
| Package | Distribution | Affected Methods | Affected Versions |
|---|---|---|---|
langgraph-checkpoint-mongodb | PyPI | MongoDBSaver.list(), MongoDBSaver.alist() | < 0.3.0 |
langgraph-store-mongodb | PyPI | MongoDBStore.search() | < 0.4.0 |
---
Advisory FAQ
How do I know if I am affected?
You are likely affected if all of the following are true:
- Your application uses
langgraph-checkpoint-mongodborlanggraph-store-mongodb. - Your application calls
MongoDBSaver.list(),MongoDBSaver.alist(), or
MongoDBStore.search() with a filter argument.
- Any part of that
filterargument is derived from user-controlled input - for example, HTTP
query parameters, request body fields, or agent tool arguments.
- You operate in a multi-tenant context where the
filteris used to enforce per-user or
per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb. If you cannot upgrade immediately, apply the following mitigation: in your application code, before passing any user-controlled input to the filter parameter, remove or escape MongoDB Query metacharacters such as “$”.
---
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
---
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
AnalysisAI
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege API caller (PR:L per CVSS) who has the ability to control or influence the filter argument passed to MongoDBSaver.list(), MongoDBSaver.alist(), or MongoDBStore.search(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and CVSS 4.0 score of 7.1 High (SC:H) both accurately characterize the cross-tenant impact: a low-privilege network attacker can trigger high confidentiality impact that escapes the vulnerable component's tenant boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade langgraph-checkpoint-mongodb to version 0.3.0 or later and langgraph-store-mongodb to version 0.4.0 or later; these are the vendor-confirmed fixed versions per advisory GHSA-533j-2v4q-mw5h. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LangGraph instances using langgraph-checkpoint-mongodb < 0.3.0 or langgraph-store-mongodb < 0.4.0, and restrict API access to MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods that accept user-controlled filter parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same technique Nosql Injection
View allShare
External POC / Exploit Code
Leaving vuln.today