EUVD-2026-77674
GHSA-533j-2v4q-mw5h
PYSEC-2026-3859
PYSEC-2026-3860
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege API credentials
-
DeliveryIdentify filter-accepting endpoint (list/search)
-
ExploitCraft filter containing MongoDB $-operator
-
ExecutionSubmit API call with injected filter
-
PersistBypass per-tenant query predicate
-
ImpactRead other tenants' checkpoint or store data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Exploitation requires an authenticated low-privilege API caller (PR:L per CVSS) who has the ability to control or influence the filter argument passed to MongoDBSaver.list(), MongoDBSaver.alist(), or MongoDBStore.search(). Three specific conditions must all be true: the application must run a vulnerable version (langgraph-checkpoint-mongodb < 0.3.0 or langgraph-store-mongodb < 0.4.0); the filter parameter must derive at least partially from user-controlled input such as HTTP query parameters, request body fields, or agent tool arguments; and the deployment must be multi-tenant, relying on filter predicates to enforce per-tenant data isolation. What limits exploitation: if the filter is built entirely from server-side trusted values, injecting operators is not possible regardless of version; single-tenant deployments have no other-tenant data to expose even if the injection succeeds. Authentication is required (PR:L) - unauthenticated exploitation is not indicated by the CVSS vector. |
| Impact | The CVSS 3.1 score of 7.7 High (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and CVSS 4.0 score of 7.1 High (SC:H) both accurately characterize the cross-tenant impact: a low-privilege network attacker can trigger high confidentiality impact that escapes the vulnerable component's tenant boundary. These scores are internally consistent and well-supported by the description. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC identified at time of analysis. Real-world risk is strongly conditional: deployments where filter values are constructed entirely from trusted server-side values face negligible practical exposure even on vulnerable versions, and single-tenant deployments face no cross-tenant risk by definition. However, multi-tenant LangGraph applications passing any user-controlled values into filter arguments on vulnerable versions face a genuine, low-complexity data exfiltration path requiring only a valid API credential. This is a real priority for that specific deployment pattern, not merely a paper-high CVSS score. |
| Exploit ScenarioDerived | An authenticated user in a multi-tenant LangGraph application crafts an HTTP request whose parameters are used to build a filter argument - for example, injecting {'$gt': ''} as a filter value when invoking a MongoDBSaver.list() API endpoint. The MongoDB query construction incorporates the operator without sanitization, causing the database to ignore or override the tenant-scoping predicate and return checkpoint documents belonging to other tenants. No public POC has been identified, but the attack requires only low-privilege API credentials and familiarity with MongoDB query operator syntax. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
RemediationAI
Upgrade langgraph-checkpoint-mongodb to version 0.3.0 or later and langgraph-store-mongodb to version 0.4.0 or later; these are the vendor-confirmed fixed versions per advisory GHSA-533j-2v4q-mw5h. Release artifacts for subsequent versions (checkpoint v0.4.0, store v0.3.0 and later) are available at the langchain-mongodb GitHub releases page. If an immediate upgrade is not possible, apply the vendor-recommended workaround in application code before invoking the affected methods: strip or reject any filter dictionary keys prefixed with '$' from user-controlled input prior to passing the filter argument. This must be enforced at the application boundary, not inside the library. Note that this workaround requires careful implementation to avoid bypasses; upgrading remains the preferred remediation. Applications that construct filter arguments exclusively from trusted, server-side values are at substantially reduced practical risk but should still upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) describes the root cause: MongoDB query operators - keys prefixed with '$' such as $gt, $where, $regex, and $elemMatch - alter query semantics when present in filter dictionaries. The langgraph-checkpoint-mongodb library (pkg:pip/langgraph-checkpoint-mongodb) provides durable state persistence for LangGraph AI agent workflows via MongoDB, while langgraph-store-mongodb (pkg:pip/langgraph-store-mongodb) provides a key-value store interface for agent memory. Both libraries pass user-supplied filter dictionaries directly to MongoDB query construction without stripping or rejecting operator-prefixed keys. In multi-tenant architectures, applications rely on filter predicates to scope queries to a specific tenant; injected operators can override or bypass those predicates, returning documents from other tenants' namespaces. The vulnerability is limited to read operations - no write or modification capability is introduced.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated low-privilege API access required (PR:L); scope changes because injection escapes tenant boundary (S:C); only confidentiality impact applies (read-only).
Primary rating from Vendor (https://github.com/langchain-ai/langchain-mongodb).
CVSS VectorVendor: https://github.com/langchain-ai/langchain-mongodb
DescriptionCVE.org
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
---
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
---
Affected Packages
| Package | Distribution | Affected Methods | Affected Versions |
|---|---|---|---|
langgraph-checkpoint-mongodb | PyPI | MongoDBSaver.list(), MongoDBSaver.alist() | < 0.3.0 |
langgraph-store-mongodb | PyPI | MongoDBStore.search() | < 0.4.0 |
---
Advisory FAQ
How do I know if I am affected?
You are likely affected if all of the following are true:
- Your application uses
langgraph-checkpoint-mongodborlanggraph-store-mongodb. - Your application calls
MongoDBSaver.list(),MongoDBSaver.alist(), or
MongoDBStore.search() with a filter argument.
- Any part of that
filterargument is derived from user-controlled input - for example, HTTP
query parameters, request body fields, or agent tool arguments.
- You operate in a multi-tenant context where the
filteris used to enforce per-user or
per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb. If you cannot upgrade immediately, apply the following mitigation: in your application code, before passing any user-controlled input to the filter parameter, remove or escape MongoDB Query metacharacters such as “$”.
---
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
---
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
Blast Radius
ecosystem impact- 2 pypi packages depend on langgraph-store-mongodb (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.4.0.
Executive ViewAI
LangGraph's MongoDB integration (versions prior to 0.3.0 for checkpoint storage and 0.4.0 for data stores) contains a vulnerability that allows authenticated API users to bypass tenant isolation and access other tenants' sensitive AI checkpoint data and conversation histories. No public exploit identified at time of analysis; however, the vulnerability represents a concrete data exposure risk in multi-tenant deployments that requires immediate attention.
No vendor-released patch identified at time of analysis. Implement strict input validation and allowlist-based filtering to reject MongoDB operator syntax in all filter parameters. Restrict API access to affected methods through network controls or API gateway rules. Enable MongoDB audit logging to detect exploitation attempts. Isolate tenant data to separate MongoDB instances or databases with distinct credentials until a vendor patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB