LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
Date: 2026-06
Affected: npm/@langchain/langgraph-checkpoint-mongodb
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-48121
CWE: CWE-943
CVSS: 6.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)

## Summary A NoSQL injection vulnerability existed in `MongoDBSaver` where checkpoint identifier fields from `config.configurable` were used in MongoDB queries without strict type enforcement. In vulnerable versions, attacker-controlled object payloads (for example MongoDB operators like `$gt` and `$ne`) could be interpreted as query operators instead of literal identifier values. This could bypass intended thread scoping and return checkpoints from other tenants. ## Attack surface The vulnerable path was in `MongoDBSaver.getTuple()`, where `thread_id`, `checkpoint_ns`, and `checkpoint_id` were used in MongoDB `find()` queries. The same unvalidated values were then reused to fetch pending writes. Applications were exposed when untrusted input was forwarded into `config.configurable` (for example, directly from request bodies or query parameters) without string coercion or schema validation. ## Who is affected? Applications are vulnerable if they: - Use `@langchain/langgraph-checkpoint-mongodb` with multi-tenant or user-isolated thread models. - Accept user-controlled values for `thread_id`, `checkpoint_ns`, or `checkpoint_id`. - Pass those values into `app.invoke()`, `app.stream()`, or direct saver methods without validation. Applications are generally not vulnerable if they: - Use server-issued identifiers only. - Source `thread_id` from trusted URL params that remain strings. - Enforce schema validation that rejects non-string identifier fields. ## Impact An att


Mitigations:

Architectural layers (MAESTRO):