CVE-2026-71433
A security vulnerability in LangGraph's checkpoint storage component with a CVSS score of 5.3. It originates from a flaw in namespace prefix-matching logic, which can enable unauthorized cross-tenant lateral read access in multi-tenant scenarios. Versions prior to 3.1.1 are affected.
Timeline (last 90 days)
CVE-2026-71433 is a vulnerability with a CVSS score of 5.3 (medium severity) that affects langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite prior to version 3.1.1.
The root cause of CVE-2026-71433 is that the Postgres and SQLite stores persist hierarchical namespaces as dot-joined strings and treat them as simple prefix pattern matches during range reads.
In multi-tenant deployments, an authenticated caller may read storage data belonging to other tenants through ordinary range searches or list_namespaces calls, constituting unauthorized lateral access.
CVE-2026-71433 has been fixed in LangGraph version 3.1.1, and upgrading is currently the only remediation.
All Facts (4)
CVE-2026-71433 is a vulnerability with a CVSS score of 5.3 (medium severity) that affects langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite prior to version 3.1.1.
50%UnverifiedThe root cause of CVE-2026-71433 is that the Postgres and SQLite stores persist hierarchical namespaces as dot-joined strings and treat them as simple prefix pattern matches during range reads.
50%UnverifiedIn multi-tenant deployments, an authenticated caller may read storage data belonging to other tenants through ordinary range searches or list_namespaces calls, constituting unauthorized lateral access.
50%UnverifiedCVE-2026-71433 has been fixed in LangGraph version 3.1.1, and upgrading is currently the only remediation.
50%