Description

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a sibling namespace whose flattened form shares the same leading characters, or a namespace label containing unescaped pattern metacharacters, allowing an authenticated caller to retrieve stored items belonging to another tenant or user through an ordinary scoped search or list namespaces call, with no crafted input required. This issue is fixed in versions 3.1.1 of langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:18:30.107Z",
  "pubdate": "2026-08-06T22:18:30.107Z",
  "executiveSummary": "An insecure prefix matching vulnerability exists in the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages prior to version 3.1.1.\nThe vulnerability allows authenticated callers to retrieve stored items belonging to another tenant or user through standard scoped search or list namespaces calls.\nThe root cause stems from persisting hierarchical namespaces as dot-joined strings and scoping database reads using unescaped simple prefix patterns.\nConsequently, a read scoped to one namespace can incorrectly match sibling namespaces whose flattened representations share leading characters, or namespaces containing unescaped pattern metacharacters.\nThis flaw leads to unauthorized cross-tenant or cross-user data exposure.\nNo crafted input or complex exploit payloads are required to trigger the condition, as ordinary operations naturally expose the logic flaw.\nThe risk is mitigated by updating the affected packages to version 3.1.1 or later.",
  "technicalDetails": "The vulnerability resides in the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages, specifically within the database query logic handling hierarchical namespaces.\nPrior to version 3.1.1, the affected components flatten hierarchical namespaces into a single dot-joined string format for persistence and retrieval.\nWhen executing read operations or listing namespaces, the database queries scope results by treating the dot-joined namespace string as a simple prefix pattern.\nThis simplistic prefix matching implementation fails to account for boundary constraints, such as dot separators or structural depth.\nAs a result, a query scoped to a specific namespace prefix unintentionally matches sibling namespaces that happen to share the same leading characters.\nFurthermore, namespace labels containing unescaped pattern metacharacters can alter the intended query matching behavior, leading to overly broad search results.\nThe attack flow requires the adversary to be an authenticated caller interacting with the application.\nBy performing an ordinary scoped search or a list namespaces call, the caller issues a request that relies on the flawed prefix matching query.\nThe underlying database executes the query using the naive prefix pattern, returning stored items and namespace identifiers belonging to other tenants or users without requiring elevated privileges or specially crafted payloads.\nThe post-exploitation impact includes the breach of multi-tenant isolation boundaries, potential exposure of sensitive state data, and unauthorized access to arbitrary checkpoints stored within the SQLite or PostgreSQL database backends."
}