CVE-2026-48121: LangGraph NoSQL injection leaks

Q: Is CVE-2026-48121 actively exploited?

No confirmed active exploitation of CVE-2026-48121 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-48121?

1. Patch immediately: Upgrade to `@langchain/langgraph-checkpoint-mongodb@1.3.1` — the patch adds runtime validation rejecting non-string checkpoint identifier values before query execution. No API changes are required for valid callers. 2. Input validation at API boundaries: Enforce strict string type validation on `thread_id`, `checkpoint_ns`, and `checkpoint_id` before passing values into `config.configurable`. Reject requests containing objects or arrays for these fields. 3. Schema enforcement: Add JSON schema or Zod validation middleware to reject non-primitive identifier fields at the route handler level, before values reach LangGraph invocation. 4. Audit existing logs: Review application logs for requests where identifier fields contained JSON objects — this pattern indicates prior exploitation attempts. 5. Workaround if patching is delayed: Coerce all configurable identifier fields to strings (`String(value)`) at the point where user input enters `config.configurable`. 6. Detection: Alert on MongoDB queries containing operator keys (`$gt`, `$ne`, `$regex`, etc.) in fields expected to hold string identifiers.

Q: What systems are affected by CVE-2026-48121?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, stateful multi-tenant AI agents, LangGraph JS applications with MongoDB persistence, multi-tenant LLM chat applications.

Q: What is the CVSS score for CVE-2026-48121?

CVE-2026-48121 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.23%.

CISO Take

A NoSQL injection flaw in `@langchain/langgraph-checkpoint-mongodb` (≤1.3.0) allows attackers to bypass multi-tenant isolation by injecting MongoDB query operators — such as `$gt` or `$ne` — into checkpoint identifier fields that flow unvalidated into database queries. With 3,296 downstream npm dependents, any multi-tenant LangGraph JS application that passes user-controlled values into `config.configurable` (thread_id, checkpoint_ns, checkpoint_id) without prior string coercion is exposed to cross-tenant checkpoint state disclosure, including agent conversation history, metadata, and pending writes. No public exploit code exists and EPSS data is unavailable, but the attack pattern is trivial to execute against any affected endpoint — an attacker needs only to supply a JSON object with MongoDB operators where a string identifier is expected. Upgrade immediately to `@langchain/langgraph-checkpoint-mongodb@1.3.1`, which adds runtime validation rejecting non-string identifiers before any query path executes.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

CVSS 6.7 Medium with an Adjacent attack vector reduces headline severity, but real-world exposure depends entirely on deployment topology. In cloud-hosted multi-tenant agent platforms where API consumers can influence graph invocation parameters, the effective risk is HIGH — an authenticated but low-privileged user can read another tenant's checkpoint state with a single crafted request. The low attack complexity and absence of any exploit barrier (no tooling required, operator payloads are trivial JSON) elevate practical risk above the CVSS score suggests. Applications using exclusively server-generated thread identifiers are not affected. Applications sourcing identifiers from request bodies or query parameters without schema validation are immediately exposed.

How does the attack unfold?

Reconnaissance

Attacker identifies a multi-tenant LangGraph JS application using MongoDB persistence by reviewing API documentation or open-source code revealing `config.configurable` parameter structure.

AML.T0095.000

Injection Crafting

Attacker replaces expected string identifier values in the API request body with MongoDB operator objects (`{"$gt": ""}`) targeting the `thread_id` and `checkpoint_ns` configurable fields.

AML.T0049

Query Bypass

MongoDBSaver.getTuple() executes the unvalidated query, causing MongoDB to match and return checkpoints across tenant boundaries instead of scoping to the attacker's authorized thread.

Cross-Tenant Exfiltration

Attacker receives another tenant's full checkpoint state — agent conversation history, tool call outputs, embedded metadata, and pending writes — without any privilege escalation.

AML.T0036

Reconnaissance

Attacker identifies a multi-tenant LangGraph JS application using MongoDB persistence by reviewing API documentation or open-source code revealing `config.configurable` parameter structure.

AML.T0095.000

Injection Crafting

Attacker replaces expected string identifier values in the API request body with MongoDB operator objects (`{"$gt": ""}`) targeting the `thread_id` and `checkpoint_ns` configurable fields.

AML.T0049

Query Bypass

MongoDBSaver.getTuple() executes the unvalidated query, causing MongoDB to match and return checkpoints across tenant boundaries instead of scoping to the attacker's authorized thread.

Cross-Tenant Exfiltration

Attacker receives another tenant's full checkpoint state — agent conversation history, tool call outputs, embedded metadata, and pending writes — without any privilege escalation.

AML.T0036

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	npm	<= 1.3.0	`1.3.1`
38.6K 3.7K dependents Pushed 5d ago 80% patched ~8d to patch Full package profile →

Do you use LangGraph? You're affected.

How severe is it?

CVSS 3.1

6.7 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Adjacent

AC Low

PR Low

UI Required

S Unchanged

C High

I High

A None

What should I do?

6 steps

Patch immediately: Upgrade to @langchain/langgraph-checkpoint-mongodb@1.3.1 — the patch adds runtime validation rejecting non-string checkpoint identifier values before query execution. No API changes are required for valid callers.
Input validation at API boundaries: Enforce strict string type validation on thread_id, checkpoint_ns, and checkpoint_id before passing values into config.configurable. Reject requests containing objects or arrays for these fields.
Schema enforcement: Add JSON schema or Zod validation middleware to reject non-primitive identifier fields at the route handler level, before values reach LangGraph invocation.
Audit existing logs: Review application logs for requests where identifier fields contained JSON objects — this pattern indicates prior exploitation attempts.
Workaround if patching is delayed: Coerce all configurable identifier fields to strings (String(value)) at the point where user input enters config.configurable.
Detection: Alert on MongoDB queries containing operator keys ($gt, $ne, $regex, etc.) in fields expected to hold string identifiers.

How is it classified?

Data Extraction Auth Bypass Data Leakage Framework Agent AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.2 - Data management for AI systems

NIST AI RMF

MEASURE 2.5 - AI system to be deployed in a trustworthy manner

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-48121?

A NoSQL injection flaw in `@langchain/langgraph-checkpoint-mongodb` (≤1.3.0) allows attackers to bypass multi-tenant isolation by injecting MongoDB query operators — such as `$gt` or `$ne` — into checkpoint identifier fields that flow unvalidated into database queries. With 3,296 downstream npm dependents, any multi-tenant LangGraph JS application that passes user-controlled values into `config.configurable` (thread_id, checkpoint_ns, checkpoint_id) without prior string coercion is exposed to cross-tenant checkpoint state disclosure, including agent conversation history, metadata, and pending writes. No public exploit code exists and EPSS data is unavailable, but the attack pattern is trivial to execute against any affected endpoint — an attacker needs only to supply a JSON object with MongoDB operators where a string identifier is expected. Upgrade immediately to `@langchain/langgraph-checkpoint-mongodb@1.3.1`, which adds runtime validation rejecting non-string identifiers before any query path executes.

Is CVE-2026-48121 actively exploited?

No confirmed active exploitation of CVE-2026-48121 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48121?

1. Patch immediately: Upgrade to `@langchain/langgraph-checkpoint-mongodb@1.3.1` — the patch adds runtime validation rejecting non-string checkpoint identifier values before query execution. No API changes are required for valid callers. 2. Input validation at API boundaries: Enforce strict string type validation on `thread_id`, `checkpoint_ns`, and `checkpoint_id` before passing values into `config.configurable`. Reject requests containing objects or arrays for these fields. 3. Schema enforcement: Add JSON schema or Zod validation middleware to reject non-primitive identifier fields at the route handler level, before values reach LangGraph invocation. 4. Audit existing logs: Review application logs for requests where identifier fields contained JSON objects — this pattern indicates prior exploitation attempts. 5. Workaround if patching is delayed: Coerce all configurable identifier fields to strings (`String(value)`) at the point where user input enters `config.configurable`. 6. Detection: Alert on MongoDB queries containing operator keys (`$gt`, `$ne`, `$regex`, etc.) in fields expected to hold string identifiers.

What systems are affected by CVE-2026-48121?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, stateful multi-tenant AI agents, LangGraph JS applications with MongoDB persistence, multi-tenant LLM chat applications.

What is the CVSS score for CVE-2026-48121?

CVE-2026-48121 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.23%.

What is the AI security impact?

Affected AI Architectures

agent frameworksstateful multi-tenant AI agentsLangGraph JS applications with MongoDB persistencemulti-tenant LLM chat applications

MITRE ATLAS Techniques

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.2

NIST AI RMF: MEASURE 2.5

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a query operator, bypassing thread scoping and leaking checkpoints, including pending writes, across tenants. Applications are at risk if they forward untrusted input into config.configurable without coercing it to strings or validating it against a schema, particularly in multi-tenant or user-isolated setups. Apps that only use server-issued, string-typed identifiers with schema validation rejecting non-string fields are not affected. This issue has been fixed in version 1.3.1.

Exploitation Scenario

An attacker registered as a standard user on a multi-tenant LangGraph-based AI agent platform crafts an API request to the agent invocation endpoint. Instead of passing a valid string `thread_id`, they supply a JSON body with `{"thread_id": {"$gt": ""}, "checkpoint_ns": {"$ne": null}}`. The backend forwards this payload directly into `config.configurable` without type coercion. `MongoDBSaver.getTuple()` constructs a `find()` query using these operator payloads, causing MongoDB to return the first matching checkpoint across all tenants rather than the attacker's scoped thread. The attacker receives another user's full agent checkpoint state — including conversation history, intermediate tool results, and any sensitive data embedded in the state graph — with no privilege escalation required beyond their existing authenticated session.

Weaknesses (CWE)

CWE-943 Improper Neutralization of Special Elements in Data Query Logic Primary CWE-943 Improper Neutralization of Special Elements in Data Query Logic Primary CWE-943 Improper Neutralization of Special Elements in Data Query Logic

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE corpus.