Critical LangGraph Vulnerability Chain Allows Full Server Control

Key Takeaways

• A critical vulnerability chain impacting LangGraph, an open-source AI agent framework, enables full server control via remote code execution.
• The flaws, including SQL injection and unsafe deserialization, affect self-hosted deployments utilizing SQLite or Redis checkpointers.
• Attackers could steal sensitive data like LLM API keys and customer information, or pivot to other internal systems.
• Patches are available, and users are urged to update LangGraph and its associated checkpointer components immediately.

A severe chain of vulnerabilities has been identified in LangGraph, a widely adopted open-source framework for building AI agents, potentially allowing attackers to achieve complete server compromise through remote code execution (RCE).

Discovered by Check Point Research, this critical flaw underscores the amplified risk traditional software vulnerabilities pose when integrated into AI systems that manage sensitive data and complex workflows.

LangGraph, developed by the creators of LangChain, is instrumental in constructing stateful AI agents capable of handling multi-step processes with large language models (LLMs). With approximately 46.5 million monthly downloads, it underpins thousands of production environments, from enterprise automation and customer support to internal business applications.

Vulnerability Chain in LangGraph

The extensive deployment of LangGraph significantly elevates the potential impact of any security weakness. The root of the vulnerability lies within LangGraph’s checkpointing mechanism, which is responsible for storing and retrieving the execution state of AI agents.

Researchers at Check Point discovered an SQL injection flaw in the get_state_history() function’s filter parameter. This vulnerability, tracked as CVE-2025-67644, allows malicious actors to manipulate database queries within the checkpointer component, specifically when using SQLite.

While an SQL injection is serious on its own, its danger escalates dramatically when combined with a second critical flaw: unsafe msgpack deserialization (CVE-2026-28277). By chaining these two vulnerabilities, an attacker can inject malicious data into the system, which then executes during the deserialization process, leading to full remote code execution on the server.

This attack path highlights how seemingly moderate individual flaws can converge to create a severe compromise within core AI framework components. A third CVE, CVE-2026-27022, was also assigned to a Redis injection vulnerability affecting an alternative checkpointer backend.

Impact and Affected Systems

The vulnerability chain primarily impacts self-hosted LangGraph deployments that utilize SQLite or Redis checkpointers and process user-controlled input. LangChain’s managed platform, LangSmith, is not affected by these specific issues.

Successful exploitation could grant attackers access to highly sensitive assets managed by the AI agent, including LLM API keys, customer data, conversation histories, and credentials for external systems like CRMs and internal APIs. Furthermore, a compromised server could serve as a pivot point, enabling attackers to launch further incursions into internal networks, significantly broadening the scope of the threat.

All identified vulnerabilities have been patched by the vendor. Users are strongly advised to upgrade their LangGraph installations immediately to secure versions. This discovery reinforces the growing concern that traditional security flaws can have far more severe consequences when present in AI systems that operate with elevated privileges and extensive access to critical data.

What You Should Do

• Upgrade Immediately: Ensure all LangGraph components are updated to the latest secure versions. Specifically, upgrade to langgraph-checkpoint-sqlite 3.0.1 or later, langgraph 1.0.10 or later, and langgraph-checkpoint-redis 1.0.2 or later.
• Review Input Validation: Implement stringent input validation and sanitization for all user-controlled data processed by LangGraph agents, especially in self-hosted environments.
• Monitor AI Agent Activity: Enhance monitoring for unusual activity or unauthorized access attempts related to your AI agents and their underlying infrastructure.
• Isolate AI Deployments: Consider segmenting AI agent deployments from critical internal networks and sensitive data stores to minimize potential lateral movement in case of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.