Skip to content

LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

High severity GitHub Reviewed Published Jun 11, 2026 in langchain-ai/langchain-mongodb • Updated Aug 20, 2026

Package

pip langgraph-checkpoint-mongodb (pip)

Affected versions

< 0.3.0

Patched versions

0.3.0
pip langgraph-store-mongodb (pip)
< 0.4.0
0.4.0

Description

Executive Summary

A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and
langgraph-store-mongodb libraries. MongoDBSaver.list() and MongoDBStore.search() methods
accept a filter parameter that is incorporated into MongoDB queries without sufficient validation.
Because MongoDB query operator keys (those prefixed with $) are not rejected during filter
construction, a caller with control of the filter input can embed MongoDB query operators
directly into the query.

CVSS Details

CVSS 4.0

Field Value
CVSS Version 4.0
Vector String CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Base Score 7.1 (High)
Metric Value Rationale
Attack Vector (AV) Network Triggerable remotely via API
Attack Complexity (AC) Low No special conditions required
Attack Requirements (AT) None No prerequisite deployment or execution conditions
Privileges Required (PR) Low Authenticated caller of the checkpoint/store API
User Interaction (UI) None No user action required
Vulnerable System Confidentiality (VC) None No direct impact on the vulnerable component itself
Vulnerable System Integrity (VI) None Read-only access
Vulnerable System Availability (VA) None No service disruption
Subsequent System Confidentiality (SC) High Full access to other tenants' checkpoint data
Subsequent System Integrity (SI) None No write or modification capability
Subsequent System Availability (SA) None No service disruption to downstream systems

CVSS 3.1

Field Value
CVSS Version 3.1
Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Base Score 7.7 (High)
Metric Value Rationale
Attack Vector Network Triggerable remotely via API
Attack Complexity Low No special conditions required
Privileges Required Low Authenticated caller of the checkpoint/store API
User Interaction None No user action required
Scope Changed Impact crosses tenant boundaries
Confidentiality High Full access to other tenants' checkpoint data
Integrity None Read-only access
Availability None No service disruption

Affected Packages

Package Distribution Affected Methods Affected Versions
langgraph-checkpoint-mongodb PyPI MongoDBSaver.list(), MongoDBSaver.alist() < 0.3.0
langgraph-store-mongodb PyPI MongoDBStore.search() < 0.4.0

Advisory FAQ

How do I know if I am affected?

You are likely affected if all of the following are true:

  1. Your application uses langgraph-checkpoint-mongodb or langgraph-store-mongodb.
  2. Your application calls MongoDBSaver.list(), MongoDBSaver.alist(), or
    MongoDBStore.search() with a filter argument.
  3. Any part of that filter argument is derived from user-controlled input — for example, HTTP
    query parameters, request body fields, or agent tool arguments.
  4. You operate in a multi-tenant context where the filter is used to enforce per-user or
    per-tenant data isolation.

If the filter argument is constructed entirely from trusted, server-side values, the practical risk is
lower, but upgrading is still recommended.

How do I fix the issue?

Upgrade to the version of langgraph-checkpoint-mongodb and langgraph-store-mongodb.
If you cannot upgrade immediately, apply the following mitigation: in your application code,
before passing any user-controlled input to the filter parameter, remove or escape MongoDB
Query metacharacters such as “$”.

Acknowledgements

Thanks to Kenichi Kawaguchi for responsibly disclosing this issue via the GitHub Security
Advisory program on the langchain-mongodb repository.

Revisions

Date Description
2026-06-05 Initial advisory published

References

@jkennedyvz jkennedyvz published to langchain-ai/langchain-mongodb Jun 11, 2026
Published to the GitHub Advisory Database Aug 20, 2026
Reviewed Aug 20, 2026
Last updated Aug 20, 2026

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS score

Weaknesses

Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. Learn more on MITRE.

CVE ID

CVE-2026-55253

GHSA ID

GHSA-533j-2v4q-mw5h

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.