AIKIDO-2026-841773

langgraph-checkpoint-postgres is vulnerable to Incorrect Authorization

CVE-2026-71433Published Aug 3, 2026

CVE Score

Medium

Incorrect Authorization

TL;DR

The Postgres store persists hierarchical namespaces as a dot-joined string and performs scoped reads by matching that string with a SQL LIKE prefix pattern. Because LIKE does not respect the . segment separator and label metacharacters such as _ and % are interpolated into the pattern unescaped, a scoped search or list_namespaces call also returns items stored under sibling namespaces whose flattened form shares leading characters. When an application uses the namespace as a tenant or user boundary, an ordinary scoped read can disclose stored items belonging to another tenant with no crafted input. The fix scopes prefix matching to exact segment boundaries, escapes metacharacters in labels, and uses segment-aware matching for prefix and suffix conditions.

How do I fix this?

Upgrade the langgraph-checkpoint-postgres and/or the langgraph-checkpoint-sqlite library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use PostgresStore/AsyncPostgresStore as a tenant or user boundary with namespace labels where one label can be a prefix of another or contains _ or %.