LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution
Researchers detail three patched LangGraph flaws, including a chain that could let attackers reach remote code execution in some self-hosted setups.
Intelligence analysis by GPT-5.4 Mini
Check Point says three patched LangGraph vulnerabilities can be chained in self-hosted deployments using SQLite or Redis checkpointing. The most serious path combines SQL injection with unsafe deserialization to turn attacker-controlled checkpoint data into code execution.
Researchers found cracks in the storage system behind an AI agent framework. In some self-hosted setups, an attacker could sneak in bad data, trick the app into reading it, and end up taking over the server like hiding a bad key inside a mailbox.
Analysis
What was found
Researchers disclosed three patched flaws in LangGraph and its checkpointing components. The most serious issue is CVE-2025-67644, a SQL injection bug in the SQLite checkpoint implementation that affects langgraph-checkpoint-sqlite versions before 3.0.1. Two other issues were also patched: CVE-2026-28277, an unsafe msgpack deserialization problem in langgraph before 1.0.10, and CVE-2026-27022, a RediSearch query injection in @langchain/langgraph-checkpoint-redis before 1.0.1.
How the chain works
Check Point says the chain is relevant to self-hosted deployments that use SQLite or Redis checkpointers with user-controlled filter input. In the scenario described, the application exposes get_state_history(), which lets an attacker request historical checkpoints by metadata. The attacker can use SQL injection to make the database return a fake checkpoint row containing attacker-controlled serialized data. When the application later processes that row, it deserializes the malicious BLOB, and the unsafe deserialization flaw can be used to execute arbitrary code.
LangGraph characterizes the deserialization issue as a post-exploitation problem: the attacker already needs write access to the checkpoint persistence layer before code execution becomes possible. Even so, the maintainers say that in the wrong deployment this escalation could expose runtime secrets or provide access to other reachable systems.
Scope and guidance
The report says LangChain’s managed LangSmith Deployment is not affected. The recommended response is straightforward: apply the latest fixes, require authentication on self-hosted servers, avoid long-lived static secrets, segment the network, and treat AI agents as privileged identities with least-privilege access.
Key points
- Three patched LangGraph vulnerabilities were disclosed, including a chain that could lead to remote code execution.
- The chain combines SQL injection in SQLite checkpointing with unsafe msgpack deserialization.
- A Redis checkpointing query injection bug was also patched.
- Check Point says the issue affects certain self-hosted deployments, not LangChain's managed LangSmith Deployment.
- Operators are advised to patch, authenticate self-hosted servers, and apply least privilege.
The flaws are already patched, and the report says LangChain’s managed LangSmith Deployment is not affected. If operators update quickly and lock down self-hosted servers, the attack path described here can be cut off before it is used in the wild. The guidance also pushes better operational hygiene around AI agents, including authentication, segmentation, and least privilege. That could reduce the blast radius of future bugs in similar agent frameworks.
Self-hosted deployments that expose checkpoint history and accept user-controlled filters may still be at risk if they lag on patches. In that case, a storage-layer flaw can become full remote code execution on a server that may hold sensitive runtime secrets. The article also suggests a broader problem: AI agent frameworks often run with elevated trust. If teams treat them like ordinary apps instead of privileged systems, a single injection or deserialization bug can open a path to other internal resources.
