CVE-2026-115883: Cross-Namespace Access via Dot-Delimited Labels in LangGraph Postgres and SQLite Stores

Vulnerability ID: CVE-2026-115883
CVSS Score: 6.0
Published: 2026-10-23

An improper input validation and authorization bypass vulnerability exists in the LangGraph storage layer affecting langgraph, langgraph-checkpoint-postgres, and langgraph-checkpoint-sqlite. Because relational store implementations serialize namespace tuples into dot-delimited strings without validating labels on read, search, delete, and batch operations, an attacker who controls a namespace label can inject periods (.) to traverse namespace boundaries and access, modify, or delete data belonging to other namespaces.

TL;DR

LangGraph relational stores (PostgreSQL and SQLite) flatten namespace tuples into dot-separated strings (e.g., ('foo', 'bar') becomes 'foo.bar'). Prior to the patch, only write operations validated against periods in namespace labels. Read, search, delete, and direct batch operations omitted this check, allowing a caller supplying ('foo.bar',) to collide with ('foo', 'bar') and bypass multi-tenant namespace isolation.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-115883 / GHSA-6hmw-9432-67qq
• CWE Classification: CWE-20 (Improper Input Validation) / CWE-863 (Incorrect Authorization)
• CVSS v4.0 Score: 6.0 Medium (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N)
• Attack Vector: Network (via unvalidated namespace label containing '.')
• Affected Components: PostgresStore, AsyncPostgresStore, SqliteStore, AsyncSqliteStore
• Primary Impact: Cross-namespace unauthorized read, search, and deletion of stored items
• Exploit Status: PoC available in upstream unit tests (PR #9217)
• CISA KEV Status: Not Listed

Affected Systems

• langgraph
• langgraph-checkpoint
• langgraph-checkpoint-postgres
• langgraph-checkpoint-sqlite
• langgraph: < 1.2.15 (Fixed in: 1.2.15)
• langgraph-checkpoint-postgres: < 3.1.3 (Fixed in: 3.1.3)
• langgraph-checkpoint-sqlite: < 3.1.2 (Fixed in: 3.1.2)
• langgraph-checkpoint: < 4.3.0 (Fixed in: 4.3.0)

Code Analysis

Commit: bfcfea5

fix(checkpoint): validate namespace labels on all store operations (#9217)

--- a/libs/checkpoint/langgraph/store/base/__init__.py
+++ b/libs/checkpoint/langgraph/store/base/__init__.py
@@ -1013,6 +1013,7 @@ class BaseStore(ABC):
     ) -> Item | None:
+        _validate_namespace_labels(namespace)
         return self.batch(
             [GetOp(namespace, str(key), refresh_ttl=_ensure_refresh(refresh_ttl))]
         )[0]
@@ -1089,6 +1090,7 @@ class BaseStore(ABC):
     def delete(self, namespace: tuple[str, ...], key: str) -> None:
+        _validate_namespace_labels(namespace)
         self.batch([PutOp(namespace, str(key), None, ttl=None)])

+def validate_op_namespace(op: Op) -> None:
+    if isinstance(op, (GetOp, PutOp)):
+        _validate_namespace_labels(op.namespace)
+    elif isinstance(op, SearchOp):
+        _validate_namespace_labels(op.namespace_prefix)
+    elif isinstance(op, ListNamespacesOp):
+        for condition in op.match_conditions or ():
+            _validate_namespace_labels(condition.path)

Exploit Details

• GitHub Pull Request #9217: Official regression tests in test_store.py and test_async_store.py demonstrating cross-namespace access via dot-containing labels.

Mitigation Strategies

• Upgrade LangGraph and its relational checkpoint store packages to the patched versions that enforce namespace label validation across all CRUD and batch operations.
• Enforce application-layer allowlist validation on all external inputs used to construct namespace tuples, rejecting periods ('.') and empty strings.
• Bind the root namespace label to an immutable, server-authenticated tenant identifier rather than client-supplied request parameters.

Remediation Steps:

1. Upgrade langgraph to >= 1.2.15 and langgraph-checkpoint to >= 4.3.0.
2. Upgrade langgraph-checkpoint-postgres to >= 3.1.3 in all deployments utilizing PostgreSQL stores.
3. Upgrade langgraph-checkpoint-sqlite to >= 3.1.2 in all deployments utilizing SQLite stores.
4. Audit application code for exception handling around InvalidNamespaceError to ensure newly rejected period-containing labels are handled gracefully.

References

• GitHub Security Advisory GHSA-6hmw-9432-67qq
• LangGraph Pull Request #9217: Validate namespace labels on all store operations
• Fix Commit bfcfea554ed5c7f7be562cebf8825e911b493ab1
• Release langgraph-checkpoint-postgres==3.1.3
• Release langgraph-checkpoint-sqlite==3.1.2
• CVE.org Record: CVE-2026-115883
• NVD Vulnerability Detail: CVE-2026-115883
• CVEListV5 Record for CVE-2026-115883

Read the full report for CVE-2026-115883 on our website for more details including interactive diagrams and full exploit analysis.