LangGraph Checkpointer: Chained SQLi-to-RCE via Unsafe msgpack Deserialization (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022)
LangGraph Checkpointer (TL-2026-0778), also tracked as From SQLi to RCE - Exploiting LangGraph's Checkpointer, is a critical-severity software vulnerability scored CVSS 7.3, first published 2026-06-11. It has no confirmed attribution, affects LangChain langgraph-checkpoint-sqlite, references 3 CVEs (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022), maps to 13 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0778
- Threat ID
- TL-2026-0778
- Also known as
- From SQLi to RCE - Exploiting LangGraph's Checkpointer, LangGraph Checkpointer SQLi-to-RCE
- Severity
- CRITICAL
- CVSS
- 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-06-11
- Last reviewed
- 2026-06-11
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, ai-ml
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Check Point Research (Yarden Porat) disclosed three chained vulnerabilities in LangGraph's persistence (checkpointer) layer for AI agent state. An unsanitized metadata filter key reachable via get_state_history() enables SQL/RediSearch injection (CVE-2025-67644 SQLite, CVE-2026-27022 Redis) to insert an attacker-controlled checkpoint row whose malicious msgpack payload, on load, triggers arbitrary command execution through importlib.import_module + os.system (CVE-2026-28277), yielding remote code execution.
How LangGraph Checkpointer works
LangGraph is a widely deployed Python framework (50+ million monthly PyPI downloads) for building stateful AI agents. Agent execution state is persisted through pluggable 'checkpointer' backends (SQLite, Redis, Postgres). Check Point Research demonstrated that two distinct vulnerability classes in the self-hosted SQLite and Redis checkpointers can be chained into full remote code execution.
The attack surface is the public get_state_history() method (and the underlying SqliteSaver.list()/alist() and RedisSaver/ShallowRedisSaver search paths), which accept a user-controlled metadata `filter` argument. In the SQLite checkpointer (CVE-2025-67644, CWE-89), the internal _metadata_predicate() helper builds the WHERE clause with an f-string: f"json_extract(CAST(metadata AS TEXT), '$.{query_key}') {operator}". Filter VALUES are bound as parameters, but filter KEYS are interpolated directly, so an attacker-controlled key injects arbitrary SQL. In the Redis checkpointer (CVE-2026-27022, CWE-74), RedisSaver and ShallowRedisSaver build RediSearch queries by interpolating filter keys and values without escaping RediSearch special syntax, enabling query injection.
The injection alone bypasses filtering and leaks all checkpoint records (thread IDs, conversation state, metadata). Chained, it is far worse: the attacker uses a UNION SELECT (SQLite) / crafted query to insert a fake checkpoint row carrying a malicious msgpack-serialized blob. When LangGraph later deserializes that checkpoint via JsonPlusSerializer.loads_typed() in msgpack mode, the _msgpack_ext_hook() handler processes an EXT_CONSTRUCTOR_SINGLE_ARG extension type and executes effectively `getattr(importlib.import_module(tup[0]), tup[1])(tup[2])` — i.e. importlib.import_module('os').system('<command>'). This is CVE-2026-28277 (CWE-502), reconstructing arbitrary Python objects from untrusted checkpoint bytes and reaching os.system for command execution in the application runtime, exposing environment variables and cloud credentials available to the process.
Managed LangSmith Deployment (which uses PostgreSQL and disallows custom checkpointers) is not affected; the risk is concentrated in self-hosted SQLite/Redis deployments that expose checkpoint-history endpoints accepting untrusted metadata filter keys. There is no confirmed exploitation in the wild as of disclosure; the work is a researcher PoC. Fixes: langgraph-checkpoint-sqlite 3.0.1 (strict key regex ^[a-zA-Z0-9_.-]+$), langgraph-checkpoint-redis 1.0.2, langgraph-checkpoint 4.0.1, and langgraph 1.0.10 (msgpack allowlist / LANGGRAPH_STRICT_MSGPACK strict mode and allowed_msgpack_modules).
MITRE ATT&CK techniques used in TL-2026-0778
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1190 Exploit Public-Facing Application
Defense Evasion
T1211 Exploitation for Stealth
Persistence
T1505 Server Software Component
Credential Access
Impact
Resource Development
Affected products and versions in LangGraph Checkpointer
- LangChain — langgraph-checkpoint-sqlite
Vulnerable versions: <= 3.0.0
Fixed in: 3.0.1 - LangChain — langgraph-checkpoint-redis
Vulnerable versions: < 1.0.2
Fixed in: 1.0.2 - LangChain — langgraph-checkpoint
Vulnerable versions: < 4.0.1
Fixed in: 4.0.1 - LangChain — langgraph
Vulnerable versions: <= 1.0.9
Fixed in: 1.0.10
Remediation for LangGraph Checkpointer
Patches
- langgraph-checkpoint-sqlite 3.0.1
- langgraph-checkpoint-redis 1.0.2
- langgraph-checkpoint 4.0.1
- langgraph 1.0.10
Immediate actions
- Upgrade langgraph-checkpoint-sqlite to >= 3.0.1
- Upgrade langgraph-checkpoint-redis to >= 1.0.2
- Upgrade langgraph-checkpoint to >= 4.0.1
- Upgrade langgraph to >= 1.0.10
- Stop accepting arbitrary metadata filter keys from untrusted/user input in get_state_history()/list()/alist()
Workarounds
- Reject untrusted filter keys before they reach the checkpointer
- Set LANGGRAPH_STRICT_MSGPACK to 1/true/yes to restrict msgpack ext reconstruction to a built-in safe set
- Do not expose checkpoint-history endpoints to untrusted clients
Longer-term hardening
- Enforce msgpack deserialization allowlisting via LANGGRAPH_STRICT_MSGPACK=1 or allowed_msgpack_modules
- Validate/allowlist metadata filter keys against ^[a-zA-Z0-9_.-]+$ at the application boundary
- Treat checkpoint/persistence stores (SQLite/Redis) as trust boundaries; restrict write access and monitor for unexpected checkpoint rows
- Run agent runtimes with least-privilege credentials and scoped environment variables to limit RCE blast radius
- Prefer managed/Postgres-backed deployments that disallow custom checkpointers where feasible
CVEs associated with LangGraph Checkpointer
CVE-2025-67644, CVE-2026-28277, CVE-2026-27022
Weaknesses (CWE) in LangGraph Checkpointer
CWE-89, CWE-502, CWE-74
Timeline of LangGraph Checkpointer
- Check Point Research discloses all three vulnerabilities (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022) to LangChain.
- GitHub advisory GHSA-9rwj-6rc7-p77c published for CVE-2025-67644 (SQLite checkpointer SQL injection), CVSS 7.3.
- CVE-2025-67644 fixed in langgraph-checkpoint-sqlite 3.0.1 with strict filter-key regex ^[a-zA-Z0-9_.-]+$; public PoC published.
- CVE-2026-27022 (Redis checkpointer RediSearch query injection) published and fixed in langgraph-checkpoint-redis 1.0.2, CVSS 6.5.
- CVE-2026-28277 published to NVD as CWE-502 with CVSS 6.8 (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); also tracked as PYSEC-2026-83.
- CVE-2026-28277 (unsafe msgpack deserialization) published; fixed in langgraph-checkpoint 4.0.1 / langgraph 1.0.10 with allowlist and LANGGRAPH_STRICT_MSGPACK strict mode, CVSS 6.8.
- Press coverage (CyberPress) reports 'Critical Flaw in LangGraph Allows Remote Code Execution via Deserialization'.
- GHSA-g48c-2wqr-h844 advisory for CVE-2026-28277 last updated.
- No confirmed exploitation in the wild observed as of disclosure; documented as a researcher proof-of-concept against self-hosted SQLite/Redis checkpointer deployments.
- Check Point Research publishes 'From SQLi to RCE - Exploiting LangGraph's Checkpointer' detailing the full chained exploit by Yarden Porat.
Sources cited for LangGraph Checkpointer
- From SQLi to RCE - Exploiting LangGraph's Checkpointer
- GHSA-9rwj-6rc7-p77c - SQL injection via metadata filter key in SQLite checkpointer list method
- CVE-2025-67644 - langgraph-checkpoint-sqlite SQL Injection (GitLab Advisories)
- SQL Injection in langgraph-checkpoint-sqlite (Snyk)
- GHSA-g48c-2wqr-h844 - LangGraph checkpoint loading has unsafe msgpack deserialization (CVE-2026-28277)
- CVE-2026-28277 - LangGraph unsafe msgpack deserialization (GitLab Advisories)
- CVE-2026-27022 - RediSearch Query Injection in langgraph-checkpoint-redis (SmartScanner)
- Red Hat CVE-2026-27022
- PoC: CVE-2025-67644 LangGraph SQLite Checkpoint SQL Injection
- Critical Flaw in LangGraph Allows Remote Code Execution via Deserialization
Threats related to LangGraph Checkpointer
- GitHub.com & GitHub Enterprise Server Pre-Auth RCE via X-Stat Header Field Injection (CVE-2026-3854)
- F5 Out-of-Band Patches for Critical NGINX HTTP/3 Use-After-Free and Proxy/gRPC Heap Overflow (CVE-2026-42530, CVE-2026-42055) plus NGINX Gateway Fabric Config Injection (CVE-2026-11311, CVE-2026-50107)
- Agent-to-Agent Privilege Boundary Failures in Google ADK for Python (adk-python) CI/CD Workflows via Cross-Agent Prompt Injection
Detection coverage for TL-2026-0778
As of 2026-06-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0778 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.