CVE-2026-106119: LangChain NoSQL injection exposes

Q: Is CVE-2026-106119 actively exploited?

No confirmed active exploitation of CVE-2026-106119 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-106119?

1) Upgrade @langchain/mongodb to 1.3.1 or later. 2) Until patched, validate that session IDs are plain strings (reject objects and operators such as $ne, $gt, $regex) before they reach the history class. 3) Derive session IDs on the server from the authenticated identity instead of accepting client values. 4) Consider separate collections or per-tenant scoping, and enforce least-privilege MongoDB credentials. 5) Detect: review application and MongoDB logs for queries on the chat history collection that contain operator keys in the session field, and for unusual read or delete volume across sessions. 6) Use the dependency inventory (SBOM) to find all services that import @langchain/mongodb.

Q: What systems are affected by CVE-2026-106119?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Conversational memory stores, Multi-tenant chatbot backends, RAG pipelines.

Q: What is the CVSS score for CVE-2026-106119?

No CVSS score has been assigned yet.

CISO Take

A flaw in the MongoDB chat message history component of LangChain (@langchain/mongodb 1.3.0 and earlier) lets an attacker pass a structured session identifier that MongoDB treats as a query condition instead of a literal string. In a shared collection, this lets one user read, modify, or delete another user's stored conversations, which can expose sensitive prompts, business data, and PII. Exploitation likelihood is currently low: EPSS is 0.00463 (62nd percentile), there is no public exploit or Nuclei template, and it is not in CISA KEV. The package is widely used, with 3,072 downstream dependents, and has 60 other CVEs, so the exposure is broad even if each deployment needs a specific setup. Upgrade @langchain/mongodb to 1.3.1 and make sure session IDs are server-generated strings, never taken from raw client input.

Sources:NVDGitHub AdvisoryEPSSOpenSSFATLAS

What is the risk?

Medium. Exploitation needs the ability to call chat-history operations with an attacker-controlled session identifier, and the application must store multiple users' histories in one shared MongoDB collection. Complexity is low once those conditions hold, and there is no sign of active exploitation. Impact covers confidentiality (reading other users' conversations), integrity (altering history), and availability of data (deletion). Applications that use authenticated, server-controlled string identifiers are not affected. No CVSS score is published, so severity relies on the vendor's medium rating.

How does the attack unfold?

Initial Access

Attacker interacts with an application endpoint that accepts a client-supplied session identifier.

AML.T0049

Exploitation

A crafted object such as a query operator is sent as the session ID and MongoDB treats it as a query condition rather than a literal string.

AML.T0049

Collection

The query matches other users' records, so the attacker reads their stored conversations.

AML.T0036

Impact

The attacker modifies or deletes other users' chat histories, corrupting memory and causing data loss.

AML.T0092

Initial Access

Attacker interacts with an application endpoint that accepts a client-supplied session identifier.

AML.T0049

Exploitation

A crafted object such as a query operator is sent as the session ID and MongoDB treats it as a query condition rather than a literal string.

AML.T0049

Collection

The query matches other users' records, so the attacker reads their stored conversations.

AML.T0036

Impact

The attacker modifies or deletes other users' chat histories, corrupting memory and causing data loss.

AML.T0092

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain	npm	<= 1.3.0	`1.3.1`
148.4KOpenSSF 6.13.1K dependentsPushed 7d ago30% patched~164d to patchFull package profile →
LangChain	pip	—	No patch
148.4KOpenSSF 6.13.1K dependentsPushed 7d ago30% patched~164d to patchFull package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade @langchain/mongodb to 1.3.1 or later. 2) Until patched, validate that session IDs are plain strings (reject objects and operators such as $ne, $gt, $regex) before they reach the history class. 3) Derive session IDs on the server from the authenticated identity instead of accepting client values. 4) Consider separate collections or per-tenant scoping, and enforce least-privilege MongoDB credentials. 5) Detect: review application and MongoDB logs for queries on the chat history collection that contain operator keys in the session field, and for unusual read or delete volume across sessions. 6) Use the dependency inventory (SBOM) to find all services that import @langchain/mongodb.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassFrameworkAPIAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0080.001- Thread AML.T0092- Manipulate User LLM Chat History

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-106119?

A flaw in the MongoDB chat message history component of LangChain (@langchain/mongodb 1.3.0 and earlier) lets an attacker pass a structured session identifier that MongoDB treats as a query condition instead of a literal string. In a shared collection, this lets one user read, modify, or delete another user's stored conversations, which can expose sensitive prompts, business data, and PII. Exploitation likelihood is currently low: EPSS is 0.00463 (62nd percentile), there is no public exploit or Nuclei template, and it is not in CISA KEV. The package is widely used, with 3,072 downstream dependents, and has 60 other CVEs, so the exposure is broad even if each deployment needs a specific setup. Upgrade @langchain/mongodb to 1.3.1 and make sure session IDs are server-generated strings, never taken from raw client input.

Is CVE-2026-106119 actively exploited?

No confirmed active exploitation of CVE-2026-106119 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-106119?

1) Upgrade @langchain/mongodb to 1.3.1 or later. 2) Until patched, validate that session IDs are plain strings (reject objects and operators such as $ne, $gt, $regex) before they reach the history class. 3) Derive session IDs on the server from the authenticated identity instead of accepting client values. 4) Consider separate collections or per-tenant scoping, and enforce least-privilege MongoDB credentials. 5) Detect: review application and MongoDB logs for queries on the chat history collection that contain operator keys in the session field, and for unusual read or delete volume across sessions. 6) Use the dependency inventory (SBOM) to find all services that import @langchain/mongodb.

What systems are affected by CVE-2026-106119?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Conversational memory stores, Multi-tenant chatbot backends, RAG pipelines.

What is the CVSS score for CVE-2026-106119?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Agent frameworksConversational memory storesMulti-tenant chatbot backendsRAG pipelines

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0080.001Thread

AML.T0092Manipulate User LLM Chat History

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.

Exploitation Scenario

An attacker uses a multi-tenant AI assistant whose API takes a session_id from the request body and passes it unchanged to MongoDBChatMessageHistory. They send a JSON object such as {"$ne": null} instead of a string. MongoDB evaluates it as a query condition and matches other users' records. The attacker then reads those users' conversations, injects forged messages to manipulate later answers, or deletes the histories.

Weaknesses (CWE)

CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE corpus.