Self-hosted LangGraph servers can be turned into a launchpad for attackers to run code on your machine, putting your AI agents and any connected services at risk.

What It Is

The flaw chain involves two high-impact vulnerabilities: a SQL injection in the SQLite checkpoint implementation (CVE-2025-67644) and an unsafe msgpack deserialization that occurs when a checkpoint is loaded (CVE-2026-28277). Both are rated high severity and, to date, exploitation remains theoretical.

Who Is Affected

Any self-hosted deployment using the SQLite checkpointer (langgraph-checkpoint-sqlite) or the Redis checkpointer (@langchain/langgraph-checkpoint-redis) is vulnerable, as is the core LangGraph library itself. The affected components can be protected by upgrading to langgraph-checkpoint-sqlite 3.0.1 or later, langgraph 1.0.10 or later, and @langchain/langgraph-checkpoint-redis 1.0.1 or later. The LangSmith deployment is not affected. The vulnerabilities were reported by Yarden Porat and involve the vendors LangChain and Check Point.

How It Works

To exploit the chain, an attacker must target a self-hosted LangGraph instance that exposes the get_state_history() endpoint and accepts user-controlled filter input. The first step is to send a malicious filter parameter that triggers the SQL injection (CVE-2025-67644), causing the database query to return a fabricated checkpoint row containing attacker-controlled serialized data. The application then processes the query results and deserialises the checkpoint BLOB.

Before the query, the attacker prepares a malicious msgpack payload carrying instructions for arbitrary code execution. When the deserialization occurs, the unsafe msgpack handling (CVE-2026-28277) activates, leading to remote code execution on the server. The impact includes full control of the compromised server, potential exposure of runtime secrets, and access to other systems reachable by the compromised runtime.

What To Do

  • Upgrade langgraph-checkpoint-sqlite to version 3.0.1 or later.
  • Upgrade langgraph to version 1.0.10 or later.
  • Upgrade @langchain/langgraph-checkpoint-redis to version 1.0.1 or later.
  • Apply the latest fixes released by the LangGraph project.
  • Implement authentication for self-hosted LangGraph servers.