LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Executive Summary
A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query operator keys (those prefixed with $) are not rejected during filter construction, a caller with control of the filter input can embed MongoDB query operators directly into the query.
CVSS Details
CVSS 4.0
| Field | Value |
|---|---|
| CVSS Version | 4.0 |
| Vector String | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| Base Score | 7.1 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector (AV) | Network | Triggerable remotely via API |
| Attack Complexity (AC) | Low | No special conditions required |
| Attack Requirements (AT) | None | No prerequisite deployment or execution conditions |
| Privileges Required (PR) | Low | Authenticated caller of the checkpoint/store API |
| User Interaction (UI) | None | No user action required |
| Vulnerable System Confidentiality (VC) | None | No direct impact on the vulnerable component itself |
| Vulnerable System Integrity (VI) | None | Read-only access |
| Vulnerable System Availability (VA) | None | No service disruption |
| Subsequent System Confidentiality (SC) | High | Full access to other tenants' checkpoint data |
| Subsequent System Integrity (SI) | None | No write or modification capability |
| Subsequent System Availability (SA) | None | No service disruption to downstream systems |
CVSS 3.1
| Field | Value |
|---|---|
| CVSS Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| Base Score | 7.7 (High) |
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network | Triggerable remotely via API |
| Attack Complexity | Low | No special conditions required |
| Privileges Required | Low | Authenticated caller of the checkpoint/store API |
| User Interaction | None | No user action required |
| Scope | Changed | Impact crosses tenant boundaries |
| Confidentiality | High | Full access to other tenants' checkpoint data |
| Integrity | None | Read-only access |
| Availability | None | No service disruption |
Affected Packages
| Package | Distribution | Affected Methods | Affected Versions |
|---|---|---|---|
langgraph-checkpoint-mongodb |
PyPI | MongoDBSaver.list(), MongoDBSaver.alist() |
< 0.3.0 |
langgraph-store-mongodb |
PyPI | MongoDBStore.search() |
< 0.4.0 |
Advisory FAQ
How do I know if I am affected?
You are likely affected if all of the following are true:
- Your application uses
langgraph-checkpoint-mongodborlanggraph-store-mongodb. - Your application calls
MongoDBSaver.list(),MongoDBSaver.alist(), orMongoDBStore.search()with afilterargument. - Any part of that
filterargument is derived from user-controlled input — for example, HTTP query parameters, request body fields, or agent tool arguments. - You operate in a multi-tenant context where the
filteris used to enforce per-user or per-tenant data isolation.
If the filter argument is constructed entirely from trusted, server-side values, the practical risk is
lower, but upgrading is still recommended.
How do I fix the issue?
Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb.
If you cannot upgrade immediately, apply the following mitigation: in your application code,
before passing any user-controlled input to the filter parameter, remove or escape MongoDB
Query metacharacters such as “$”.
Acknowledgements
Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security Advisory program on the langchain-mongodb repository.
Revisions
| Date | Description |
|---|---|
| 2026-06-05 | Initial advisory published |
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | langgraph-checkpoint-mongodb | < 0.3.0 | 0.3.0 |
| Python (PyPI) | langgraph-store-mongodb | < 0.4.0 | 0.4.0 |
References
- https://github.com/langchain-ai/langchain-mongodb/security/advisories/GHSA-533j-2v4q-mw5h
- https://github.com/langchain-ai/langchain-mongodb
- https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-checkpoint-mongodb%2Fv0.4.0
- https://github.com/langchain-ai/langchain-mongodb/releases/tag/libs%2Flanggraph-store-mongodb%2Fv0.3.0
- https://pypi.org/project/langgraph-checkpoint-mongodb
- https://github.com/advisories/GHSA-533j-2v4q-mw5h
- https://nvd.nist.gov/vuln/detail/CVE-2026-55253
- https://pypi.org/project/langgraph-store-mongodb
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N- Weakness (CWE)
CWE-943- Platform
- Python (PyPI)
- Package
langgraph-checkpoint-mongodb, langgraph-store-mongodb- Disclosed
- 20.08.2026
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3859 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-533j-2v4q-mw5h - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-3860 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: langgraph-checkpoint-mongodb
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.