CVE-2026-71433: SQL Injection via Namespace Prefix Matching in langgraph-checkpoint

Vulnerability Overview Vulnerability Name: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores Vulnerability Description: Postgres and SQLite stores persist hierarchical namespaces as dot-separated strings (e.g., "memories", "alice" becomes ) and perform range reads using . Since lacks the concept of a delimiter, range searches or also match adjacent flattened namespaces. Impact: Confidentiality: Items stored may leak to namespaces outside the scope expected by the caller. Integrity or Availability: No impact, as , , and compare namespaces using and have never been affected; the issue is limited to the read path. Scope of Impact Affected Packages: langgraph-checkpoint-postgres langgraph-checkpoint-sqlite Affected Versions: < 3.1.1 Patch Version: 3.1.1 CVE ID: CVE-2026-71433 CVSS v3 Base Metrics: Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None Remediation Patch/Mitigation: Prefix ranges now strictly match the namespace or require a delimiter before the remainder. Pattern metacharacters in tags are escaped. uses segment-aware matching for prefix and suffix conditions. In SQLite, descendant matching has moved from to . Since is case-insensitive for ASCII, previously matched distinct namespaces during range reads are now treated as different. Search results are now consistent. Upgrade Recommendation: Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1. Compatibility In , matching paths now span exactly one namespace segment. This restores documented behavior: ("cache", "", "v1") matches "any cache category with v1 version." The multi-segment matching in InMemoryStore was a side effect of translating "" to the SQL "%" wildcard; the same mechanism responsible for this issue cannot be preserved without fixing it. Callers relying on previous behavior: "Match at any depth" can be expressed by combining two match conditions, joined with AND: Applications where tags cannot be a prefix of another: No behavior change. Operational Guidelines Prefer fixed-length namespace tags, such as UUIDs, so that no tag can be a prefix of another. When tags are user-provided, validate them at boundaries rather than relying on the range itself. LangSmith / Managed Deployment Notes Unlike previous storage recommendations, this issue also affects managed deployments. LangSmith deployments default to , which uses from . Deployments configured with use a separate implementation that has received an equivalent fix.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-71433: SQL Injection via Namespace Prefix Matching in langgraph-checkpoint

More from this source