LangGraph in check for three critical vulnerabilities that can allow remote code execution in self-housed facilities

Security researchers have revealed three already corrected vulnerabilities in LangGraph, the open source framework developed by LangChain to build state and multi-agent IA agents. The most critical is a chain of failures - SQL injection more unsafe deserialization - that, in self-hosted facilities, can allow remote code execution (CERs) if the application exposes certain endpoints and uses the affected persistence modules.

The identified failures include CVE-2025-67644, an SQL injection in the SQLite implementation of the checkpointer that allows to manipulate consultations through metadata filters (affects langgraph-checkpoint-sqlite before version 3.0.1); CVE-2026-28277, an unsafe deerialization of msgpack that opens the door to the reconstruction of malicious objects when carrying checkpoints (affects longgraph before version 1.0.10); and CVE-2026-27022, an injection in RediSearch consultations that can avoid access controls in @ langchain / langgraph-checkpoint-redis ( before version 1.0.1). The findings were attributed to the researcher Yarden Porat and published along with the analysis of Check Point.

The most serious attack vector described by the researchers first combines SQL injection to return a row of counterfeit checkpoint and then forces the application to deerialize a BLOB msgpack controlled by the attacker, which can run the embedded payload. This is dependent on the service's ability to read metadata checkpoints (e.g. by getting _ state _ history ()) and the attacker's ability to influence the filters or data from the checkpoints warehouse..

It is important to stress that the configurations managed by LangChain (LangSmith Deployment) are not affected by this scenario in the threat model described, because the typical environments housed do not allow direct handling of the storage of checkpoints. However, in own deployments (self-hosted) the exposure of endpoints without authentication and the lack of protections in the persistence layer can convert classic failures such as SQL injection into critical vectors against IA infrastructure.

From a practical point of view, operators should prioritize the application of updates published by LangGraph and LangChain. Update to langgraph 1.0.10, langgraph-checkpoint-sqlite 3.0.1 and @ langchain / langgraph-checkpoint-redis 1.0.1(or higher versions) closes these known vulnerabilities. In addition, it is appropriate to review telemetry and log for retrospective detection of suspicious queries or checkpoints and to audit access to the checkpoints warehouse.

Beyond the immediate patch, compensatory mitigation is key: enabling robust authentication and authorization in any endpoint that exposes history or checkpoints; avoiding long-term static secrets in agent runtimes; segmenting networks so that storage services (SQLite / Reis) are not accessible from public areas; and applying the principle of lesser privilege to agents, treating them as privileged identities with restricted access to specific resources.

At the development level, it is essential to correct the root: use parametered consultations and strict validation of filters before incorporating them into SQL consultations, introduce signature or integrity of checkpoints to prevent the load of manipulated data, and replace or mitigate unsafe deerialization by safe formats or strict validations. For the deerialization of binary data it is recommended to verify schemes, use libraries that impose limits and, where possible, avoid the execution of code from reconstructed objects.

Operators who cannot park immediately should at least disable or protect endpoint get _ state _ history (), restrict access to the database and service from unreliable networks, rotate credentials and keys, and establish monitoring and alerts on unusual operations in the persistence layer. Consider the use of isolated execution environments and the prohibition of unnecessary privileges reduces the impact of a possible escalation.

This case replaces in the foreground that well-known vulnerabilities (SQL injection, unsafe deerialization) charge a new dimension when found within frameworks of IA agents that handle secrets, credentials and connections to other systems. For more context on deerialization attacks and good practices against SQL injection, see the OWASP guide on unsafe deerialization and OWASP documentation on SQL injection. For information and releases of the discovery and corrections, you can review the researchers' notice and the LangChain repository in GitHub: Check Point Research, OWASP, GitHub - LangChain.