Cybersecurity researchers have disclosed details of three now-patched security flaws affecting LangGraph, including a critical chain of vulnerabilities that could lead to remote code execution.
LangGraph is an open-source framework developed by LangChain for building complex, stateful, and multi-agent artificial intelligence (AI) agentic applications.
"An SQL injection in LangGraph's function could allow attackers to gain full control via remote code execution of a server by exploiting weaknesses in how the system processes and handles data," Check Point stated.
The list of identified vulnerabilities is as follows:
CVE-2025-67644 (CVSS score: 7.3) - A SQL injection vulnerability exists in LangGraph's SQLite checkpoint implementation, enabling attackers to manipulate SQL queries through metadata filter keys. (Affects langgraph-checkpoint-sqlite versions prior to 3.0.1)
CVE-2026-28277 (CVSS score: 6.8) - An unsafe msgpack deserialization vulnerability in LangGraph that could be exploited to trigger object reconstruction when a checkpoint is loaded by an attacker capable of modifying checkpoint data. (Affects langgraph versions prior to 1.0.10)
CVE-2026-27022 (CVSS score: 6.5) - A RediSearch Query Injection in @langchain/langgraph-checkpoint-redis that can be used to bypass access controls. (Affects @langchain/langgraph-checkpoint-redis versions prior to 1.0.1)
"The vulnerability chain is exploitable in self-hosted deployments using the SQLite or Redis checkpointer with user-controlled filter input," Check Point said. "LangChain's managed platform (LangSmith Deployment) is not affected."
Security researcher Yarden Porat, credited with discovering and reporting all three flaws, stated that CVE-2025-67644 and CVE-2026-28277 could be combined to achieve remote code execution.
Specifically, the attack chain relies on the application exposing the get_state_history() endpoint, which then enables an attacker to retrieve historical checkpoints based on their metadata. It requires the following steps:
- The attacker prepares a msgpack payload containing instructions to execute arbitrary code. - The attacker sends a malicious filter parameter that exploits the SQL injection vulnerability to return a fake checkpoint row to the database query results, where the checkpoint column contains attacker-controlled serialized data. - When the application processes the query results, it deserializes the malicious checkpoint's BLOB. - The attacker exploits the unsafe deserialization vulnerability to execute the attacker's payload, granting them remote code execution on the server.
LangGraph has characterized CVE-2026-28277 as a post-exploitation issue, where successful exploitation requires the ability to write attacker-controlled checkpoint data and convert that into code execution in the application runtime, and it poses no risks to existing LangSmith-hosted deployments.
In such a scenario, this escalation from write access to checkpoint store to code execution may "expose runtime secrets or provide access to other systems the runtime can reach," LangGraph maintainers said. "The described threat model requires an attacker to tamper with the checkpoint persistence layer used by the deployment; typical hosted configurations are designed to prevent such access."
Check Point stated that the findings illustrate how classic vulnerability categories like SQL injection can become more potent when they occur within AI agent frameworks that carry elevated access and trust, thereby opening the door to sensitive data exposure.
Users are advised to apply the latest fixes, implement authentication for self-hosted LangGraph servers, avoid long-lived static secrets, enforce network segmentation, treat AI agents as privileged identities, and apply the principle of least privilege (PoLP) to limit the agent's access footprint.