Three now-patched flaws in LangChain's popular LangGraph framework can be chained for full remote code execution on self-hosted AI agent servers, security researchers warned on Friday — exposing LLM API keys, customer data and conversation histories.
The Three CVEs
Researcher Yarden Porat disclosed the bugs after coordinating with LangChain on patches:
- CVE-2025-67644 (CVSS 7.3) — a SQL injection in LangGraph's SQLite checkpoint implementation that lets attackers tamper with metadata filter keys.
- CVE-2026-28277 (CVSS 6.8) — unsafe
msgpackdeserialization that triggers attacker-controlled object reconstruction when a poisoned checkpoint is loaded. - CVE-2026-27022 (CVSS 6.5) — RediSearch query injection in
@langchain/langgraph-checkpoint-redisthat bypasses access controls.
The Chain: From Checkpoint To Shell
The first two flaws can be chained to achieve full remote code execution, Porat said. The chain is exploitable in self-hosted deployments using LangGraph's SQLite or Redis checkpointer with user-controlled filter input — a common pattern in multi-tenant agentic apps. Successful exploitation hands attackers the keys to LLM accounts, CRM connectors and internal API credentials that the agent has been wired into.
Patch Now
LangChain has shipped fixes in the latest LangGraph and Redis checkpointer releases and is urging operators of self-hosted deployments to upgrade immediately, audit checkpoint stores for tampering, and rotate any credentials reachable from the agent runtime.
The disclosure lands amid a broader uptick in supply-chain hits on AI tooling. See our coverage of the Agentjacking attack via Sentry and the Splunk pre-auth RCE disclosed this week.
Reporting based on coverage from The Hacker News, Cyber Press and Cybersecurity News.