CVE-2026-115883: LangGraph namespace label

Q: Is CVE-2026-115883 actively exploited?

No confirmed active exploitation of CVE-2026-115883 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115883?

1. Upgrade langgraph-checkpoint-postgres to 3.1.3 and langgraph-checkpoint-sqlite to 3.1.2 or later. 2. Inventory services that use the affected store classes with pip list or SBOM tooling, prioritizing multi-tenant systems. 3. Until patched, reject any namespace label containing '.' at your application layer for every operation, not only writes, and never build labels from raw user input. Derive tenant namespaces from authenticated server-side identity. 4. Add database-level isolation such as row-level security or separate schemas or databases per tenant where feasible. 5. Detect abuse by auditing store access logs for namespace labels containing dots or for access to namespaces outside the caller's tenant, and by watching for unexpected deletions or overwrites in the store tables. 6. Review the GHSA-6hmw-9432-67qq advisory and the linked fix commit for the validation changes.

Q: What systems are affected by CVE-2026-115883?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent platforms, long-term agent memory stores, stateful LLM workflows.

Q: What is the CVSS score for CVE-2026-115883?

No CVSS score has been assigned yet.

CISO Take

LangGraph's Postgres and SQLite store classes flatten namespace tuples into dotted strings but only validate labels on write operations, so a crafted label on a read, search, delete or list call can resolve to another tenant's namespace. That allows cross-tenant reads, overwrites or deletion of agent memory and state. No CVSS or EPSS score has been published, no exploit or scanner template exists, and the CVE is not in CISA KEV, so we have no evidence of active exploitation. The blast radius is still notable: langgraph has 4,059 downstream dependents, and multi-tenant agent platforms that build namespaces from user input are the most exposed. Upgrade langgraph-checkpoint-postgres to 3.1.3 and langgraph-checkpoint-sqlite to 3.1.2, and review how namespace labels are built until then.

Sources:NVDGitHub AdvisoryATLASlangchain-ai/langgraph GitHub

What is the risk?

Medium severity, but real exposure depends on architecture. The flaw requires an attacker to control or influence namespace label values passed to get, search, delete, list_namespaces or batch operations, which is typical in multi-tenant SaaS agents that derive namespaces from user or session identifiers. Exploitation is simple once such a path exists and needs no special AI knowledge. No public exploit, Nuclei template or KEV listing exists, and EPSS and CVSS data are unavailable, so likelihood is uncertain. Impact covers confidentiality (cross-tenant reads), integrity (overwrites) and availability (deletions) of stored agent memory. Single-tenant deployments and InMemoryStore users are not affected. The package has 16 other CVEs, which points to a history of security issues in this ecosystem.

How does the attack unfold?

Initial Access

An authenticated tenant user supplies a namespace label containing a dot to an agent endpoint that passes it to a store read, search, delete or list call.

AML.T0049

Exploitation

The store joins labels with '.', so the crafted label resolves to another tenant's flattened namespace, and validation is skipped on non-put operations.

Collection

The attacker reads or searches the victim namespace to retrieve stored agent memory and state.

AML.T0036

Impact

The attacker overwrites or deletes victim entries, poisoning agent memory or destroying persisted workflow state.

AML.T0101

Initial Access

An authenticated tenant user supplies a namespace label containing a dot to an agent endpoint that passes it to a store read, search, delete or list call.

AML.T0049

Exploitation

The store joins labels with '.', so the crafted label resolves to another tenant's flattened namespace, and validation is skipped on non-put operations.

Collection

The attacker reads or searches the victim namespace to retrieve stored agent memory and state.

AML.T0036

Impact

The attacker overwrites or deletes victim entries, poisoning agent memory or destroying persisted workflow state.

AML.T0101

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	pip	—	No patch
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →
LangGraph	pip	< 3.1.3	`3.1.3`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →
LangGraph	pip	< 3.1.2	`3.1.2`
43.8K4.1K dependentsPushed 7d ago77% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

6 steps

Upgrade langgraph-checkpoint-postgres to 3.1.3 and langgraph-checkpoint-sqlite to 3.1.2 or later.
Inventory services that use the affected store classes with pip list or SBOM tooling, prioritizing multi-tenant systems.
Until patched, reject any namespace label containing '.' at your application layer for every operation, not only writes, and never build labels from raw user input. Derive tenant namespaces from authenticated server-side identity.
Add database-level isolation such as row-level security or separate schemas or databases per tenant where feasible.
Detect abuse by auditing store access logs for namespace labels containing dots or for access to namespaces outside the caller's tenant, and by watching for unexpected deletions or overwrites in the store tables.
Review the GHSA-6hmw-9432-67qq advisory and the linked fix commit for the validation changes.

How is it classified?

Auth BypassData LeakageFrameworkAgentAML.T0036- Data from Information Repositories AML.T0080.000- Memory AML.T0101- Data Destruction via AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-115883?

LangGraph's Postgres and SQLite store classes flatten namespace tuples into dotted strings but only validate labels on write operations, so a crafted label on a read, search, delete or list call can resolve to another tenant's namespace. That allows cross-tenant reads, overwrites or deletion of agent memory and state. No CVSS or EPSS score has been published, no exploit or scanner template exists, and the CVE is not in CISA KEV, so we have no evidence of active exploitation. The blast radius is still notable: langgraph has 4,059 downstream dependents, and multi-tenant agent platforms that build namespaces from user input are the most exposed. Upgrade langgraph-checkpoint-postgres to 3.1.3 and langgraph-checkpoint-sqlite to 3.1.2, and review how namespace labels are built until then.

Is CVE-2026-115883 actively exploited?

No confirmed active exploitation of CVE-2026-115883 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115883?

1. Upgrade langgraph-checkpoint-postgres to 3.1.3 and langgraph-checkpoint-sqlite to 3.1.2 or later. 2. Inventory services that use the affected store classes with pip list or SBOM tooling, prioritizing multi-tenant systems. 3. Until patched, reject any namespace label containing '.' at your application layer for every operation, not only writes, and never build labels from raw user input. Derive tenant namespaces from authenticated server-side identity. 4. Add database-level isolation such as row-level security or separate schemas or databases per tenant where feasible. 5. Detect abuse by auditing store access logs for namespace labels containing dots or for access to namespaces outside the caller's tenant, and by watching for unexpected deletions or overwrites in the store tables. 6. Review the GHSA-6hmw-9432-67qq advisory and the linked fix commit for the validation changes.

What systems are affected by CVE-2026-115883?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent platforms, long-term agent memory stores, stateful LLM workflows.

What is the CVSS score for CVE-2026-115883?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant agent platformslong-term agent memory storesstateful LLM workflows

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0080.000Memory

AML.T0101Data Destruction via AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples. This issue is fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.

Exploitation Scenario

A multi-tenant customer-support platform runs LangGraph agents with PostgresStore and builds the namespace as (tenant_id, user_id) from request parameters. An authenticated user of tenant A submits a user identifier containing a dot, such as 'victimtenant.user42'. Validation only runs on writes, so the read path joins labels into 'tenantA.victimtenant.user42', which can collide with another tenant's flattened namespace. The attacker calls search or get through the agent and retrieves tenant B's stored memories, then overwrites an entry with misleading instructions or deletes records to disrupt that tenant's agent.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input ValidationPrimary CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect AuthorizationPrimary CWE-20Improper Input Validation CWE-863Incorrect Authorization

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.