Disclosed vulnerability
LangGraph checkpointer chain: SQL injection in the SQLite/Redis stores plus unsafe msgpack deserialization equals RCE on self-hosted agents
AIR-2026-0134 AIR record · 2026-06-langgraph-checkpointer-sqli-to-rce
From the supporting source
If we pass a msgpack with EXT_CONSTRUCTOR_SINGLE_ARG coderesearch.checkpoint.com
The record
Disclosed
2026-06-11
Vendor
LangChain Inc.
Product
LangGraph (langgraph-checkpoint-sqlite, langgraph-checkpoint-redis, langgraph)
Risk domain
Agent output quality › Hallucination
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — SQLi plus unsafe msgpack deserialization in the checkpointer
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
User controlled filter to get state history
Impact type
Remote code execution, Server takeover
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI08 – Cascading Failures
- MITRE ATLAS
- AML.T0062 – Discover LLM Hallucinations
- NIST AI RMF
- MEASURE 2.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 24029-1
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Implement fact-checking via knowledge base/RAG; Tune model temperature/top-p.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
self-hosted LangGraph deployments using the SQLite or Redis checkpointer; LangSmith Deployment (managed, PostgreSQL) was not vulnerable
Capability abused
Defense & remediation
Recorded defense
none - the filter parameter was interpolated into the WHERE clause and checkpoint blobs were msgpack-deserialized without type restriction
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
langgraph-checkpoint-sqlite 3.0.1+, langgraph 1.0.10+, langgraph-checkpoint-redis 1.0.2+
Taxonomy & references
Curator notes
Check Point Research, published 2026-06-11. Three CVEs disclosed as one chain: CVE-2025-67644 (SQLi in SQLite checkpointer), CVE-2026-28277 (unsafe msgpack deserialization allowing os.system via EXT_CONSTRUCTOR_SINGLE_ARG), CVE-2026-27022 (same injection class in the Redis checkpointer). Attack requires the application to expose get_state_history() with a user-controlled filter. This is the agent-memory-store deserialization class in its purest form.
Supporting sources
Cite as
Enkrypt AI. "LangGraph checkpointer chain: SQL injection in the SQLite/Redis stores plus unsafe msgpack deserialization equals RCE on self-hosted agents". AIR, AIR-2026-0134. https://agentincident.vercel.app/i/AIR-2026-0134/ (accessed 2026-10-19).