CVE-2026-115883

Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-postgres versions prior to 3.1.3 langgraph-checkpoint-sqlite versions prior to 3.1.2

Description PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels using ".".join(namespace), which allows a label containing a dot to resolve to a different tenant's stored namespace. While put() and aput() validate labels, other methods such as get(), search(), delete(), list namespaces(), and their asynchronous equivalents, as well as direct batch() and abatch() operations, do not perform this validation. An attacker providing a crafted label containing dots can perform cross-namespace reads, overwrites, or deletions of another tenant's data.

Recommendations Upgrade langgraph-checkpoint-postgres to version 3.1.3. Upgrade langgraph-checkpoint-sqlite to version 3.1.2.