LangGraph Flaw Chain Enables Remote Code Execution on Self-Hosted AI Agents

Cybersecurity researchers at Check Point have disclosed three now-patched security flaws in LangGraph, an open-source framework by LangChain for building stateful, multi-agent AI applications. The vulnerabilities, if chained, could allow attackers to achieve remote code execution (RCE) on self-hosted deployments.

The identified vulnerabilities are:

• CVE-2025-67644 (CVSS 7.3): SQL injection in LangGraph’s SQLite checkpoint implementation, allowing manipulation of SQL queries via metadata filter keys. Affects langgraph-checkpoint-sqlite versions before 3.0.1.
• CVE-2026-28277 (CVSS 6.8): Unsafe msgpack deserialization vulnerability that enables object reconstruction when a checkpoint is loaded by an attacker with checkpoint data modification capabilities. Affects langgraph versions before 1.0.10.
• CVE-2026-27022 (CVSS 6.5): RediSearch Query Injection in @langchain/langgraph-checkpoint-redis, allowing access control bypass. Affects versions before 1.0.1.

The attack chain requires the application to expose the get_state_history() endpoint. An attacker sends a malicious filter parameter exploiting the SQL injection to return a fake checkpoint row containing attacker-controlled serialized data. When the application deserializes this data, the unsafe deserialization vulnerability triggers arbitrary code execution. LangGraph maintainers note that CVE-2026-28277 is a post-exploitation issue requiring write access to the checkpoint store, and LangSmith-hosted deployments are not affected.

Check Point emphasizes that classic vulnerabilities like SQL injection become more dangerous within AI agent frameworks due to elevated access and trust. Users are advised to apply the latest fixes, implement authentication for self-hosted servers, avoid long-lived static secrets, enforce network segmentation, treat AI agents as privileged identities, and apply the principle of least privilege.