CVE-2026-55253: LangGraph NoSQL injection exposes

CISO Take

A NoSQL injection flaw in langgraph-checkpoint-mongodb and langgraph-store-mongodb lets a caller who controls the filter argument to MongoDBSaver.list() or MongoDBStore.search() smuggle in raw MongoDB query operators (keys prefixed with $), because the library never rejects them before building the query. For any multi-tenant LangGraph deployment that uses this filter to enforce per-user or per-tenant scoping — common in agent SaaS products storing conversation checkpoints and long-term agent memory in MongoDB — this collapses tenant isolation and lets one user read another tenant's full checkpoint/store data (CVSS 3.1 7.7, Scope Changed, C:H). There is no known public exploit or scanner template, no EPSS score, and it is not in CISA KEV, so this looks opportunistic rather than under active attack today, but the package sits behind 3,763 downstream dependents, meaning many LangGraph-based agent applications carry this dependency without necessarily having built their own filter-input validation. Patch by upgrading to langgraph-checkpoint-mongodb >=0.3.0 and langgraph-store-mongodb >=0.4.0; if you can't upgrade immediately, strip or reject any $-prefixed keys from user-controlled input before it reaches the filter parameter, and monitor logs for filter values containing MongoDB operators as a detection signal.

Sources:NVDGitHub AdvisoryCISA KEVATLAS

What is the risk?

Exploitability is low-complexity (AC:L, no special conditions, no user interaction) and requires only low privileges and network access, but the flaw is gated on the deploying application actually passing user-controlled data into the filter parameter — not every LangGraph+MongoDB integration is exposed. Where it is exposed (e.g., a thread_id or metadata filter fed from HTTP query params, request bodies, or agent tool arguments), the blast radius is severe: full read access to other tenants' checkpoint/store history with no write or availability impact (Scope Changed, C:H/I:N/A:N). No active exploitation, EPSS score, or scanner coverage exists yet, so this should be treated as a high-priority patch item rather than an active-incident response, but the large dependent base (3,763) and the fact this affects data-isolation logic in multi-tenant agent products raise the practical urgency.

How does the attack unfold?

Entry Point

Attacker obtains authenticated, low-privilege access to an application endpoint or agent tool that passes user-controlled input into a MongoDBSaver/MongoDBStore filter parameter.

AML.T0053

Injection

Attacker embeds MongoDB query operators (e.g. $ne, $regex, $or) into the filter value, which the library passes through unvalidated since it never rejects $-prefixed keys.

AML.T0036

Tenant Isolation Bypass

The injected operators override or widen the intended tenant-scoping clause, causing the query to match checkpoint/store documents belonging to other tenants.

Impact

Attacker exfiltrates other tenants' full agent checkpoints and store entries via the API response, exposing conversation history, memory, and any embedded sensitive data.

AML.T0057

Entry Point

Attacker obtains authenticated, low-privilege access to an application endpoint or agent tool that passes user-controlled input into a MongoDBSaver/MongoDBStore filter parameter.

AML.T0053

Injection

Attacker embeds MongoDB query operators (e.g. $ne, $regex, $or) into the filter value, which the library passes through unvalidated since it never rejects $-prefixed keys.

AML.T0036

Tenant Isolation Bypass

The injected operators override or widen the intended tenant-scoping clause, causing the query to match checkpoint/store documents belonging to other tenants.

Impact

Attacker exfiltrates other tenants' full agent checkpoints and store entries via the API response, exposing conversation history, memory, and any embedded sensitive data.

AML.T0057

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangGraph	pip	< 0.3.0	`0.3.0`
44.2K4.1K dependentsPushed today77% patched~9d to patchFull package profile →
LangGraph	pip	< 0.4.0	`0.4.0`
44.2K4.1K dependentsPushed today77% patched~9d to patchFull package profile →

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade langgraph-checkpoint-mongodb to >=0.3.0 and langgraph-store-mongodb to >=0.4.0 — both releases reject/sanitize $-prefixed operator keys in filter input. 2) If immediate upgrade isn't possible, add an allowlist or sanitizer in your own code that strips any key starting with $ from filter dicts before passing them to .list(), .alist(), or .search(). 3) Never build the tenant-scoping clause directly from unsanitized user or agent input — construct the tenant/user ID clause server-side and merge it last (or with $and) so it cannot be overridden by an injected operator. 4) For detection, log and alert on filter values containing MongoDB operator keys ($ne, $regex, $where, $or, $exists) originating from request bodies, query params, or agent tool call arguments.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAgentAML.T0036- Data from Information Repositories AML.T0053- AI Agent Tool Invocation AML.T0057- LLM Data Leakage

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

Annex A.8 (AI system security)-Security controls for AI system components

OWASP LLM Top 10

LLM06-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-55253?

A NoSQL injection flaw in langgraph-checkpoint-mongodb and langgraph-store-mongodb lets a caller who controls the filter argument to MongoDBSaver.list() or MongoDBStore.search() smuggle in raw MongoDB query operators (keys prefixed with $), because the library never rejects them before building the query. For any multi-tenant LangGraph deployment that uses this filter to enforce per-user or per-tenant scoping — common in agent SaaS products storing conversation checkpoints and long-term agent memory in MongoDB — this collapses tenant isolation and lets one user read another tenant's full checkpoint/store data (CVSS 3.1 7.7, Scope Changed, C:H). There is no known public exploit or scanner template, no EPSS score, and it is not in CISA KEV, so this looks opportunistic rather than under active attack today, but the package sits behind 3,763 downstream dependents, meaning many LangGraph-based agent applications carry this dependency without necessarily having built their own filter-input validation. Patch by upgrading to langgraph-checkpoint-mongodb >=0.3.0 and langgraph-store-mongodb >=0.4.0; if you can't upgrade immediately, strip or reject any $-prefixed keys from user-controlled input before it reaches the filter parameter, and monitor logs for filter values containing MongoDB operators as a detection signal.

Is CVE-2026-55253 actively exploited?

No confirmed active exploitation of CVE-2026-55253 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55253?

1) Upgrade langgraph-checkpoint-mongodb to >=0.3.0 and langgraph-store-mongodb to >=0.4.0 — both releases reject/sanitize $-prefixed operator keys in filter input. 2) If immediate upgrade isn't possible, add an allowlist or sanitizer in your own code that strips any key starting with $ from filter dicts before passing them to .list(), .alist(), or .search(). 3) Never build the tenant-scoping clause directly from unsanitized user or agent input — construct the tenant/user ID clause server-side and merge it last (or with $and) so it cannot be overridden by an injected operator. 4) For detection, log and alert on filter values containing MongoDB operator keys ($ne, $regex, $where, $or, $exists) originating from request bodies, query params, or agent tool call arguments.

What systems are affected by CVE-2026-55253?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, agent memory and checkpointing, multi-tenant SaaS AI platforms.

What is the CVSS score for CVE-2026-55253?

CVE-2026-55253 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksagent memory and checkpointingmulti-tenant SaaS AI platforms

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0053AI Agent Tool Invocation

AML.T0057LLM Data Leakage

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.8 (AI system security)

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() incorporate filter dictionaries into MongoDB queries without recursively rejecting keys prefixed with $. An authenticated caller who controls a filter argument through HTTP query parameters, request body fields, or agent tool arguments can inject MongoDB Query Language operators such as $regex or $where. In a multi-tenant deployment that uses the filter to enforce per-user or per-tenant isolation, injected operators can bypass intended equality filtering and expose other tenants' checkpoint or store data. Filters constructed entirely from trusted server-side values have lower practical risk. This issue is fixed in langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0.

Exploitation Scenario

A SaaS company runs a multi-tenant AI agent product on LangGraph, using MongoDBStore to persist each customer's long-term agent memory, intending to scope results by a tenant_id field in the filter. The product exposes a 'search my agent's memory' API where the request body's metadata filter is merged directly into the MongoDBStore.search() filter argument. An authenticated attacker on a low-privilege tenant sends a filter such as {"metadata.tenant_id": {"$ne": "attacker-tenant"}} instead of a normal equality match; because the library does not strip $-prefixed keys, this negation operator matches every other tenant's memory records instead of being scoped to their own, returning cross-tenant conversation history, tool outputs, and any sensitive data embedded in other customers' agent sessions.

Weaknesses (CWE)

CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query LogicPrimary CWE-943Improper Neutralization of Special Elements in Data Query Logic

CWE-943 — Improper Neutralization of Special Elements in Data Query Logic: The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE corpus.