LangGraph MongoDB checkpoint and store: filter dicts allow MQL operator injection across tenants

Impact

MongoDBSaver.list(), .alist() and MongoDBStore.search() splice caller-supplied filter dictionaries into MongoDB queries without recursively rejecting $-prefixed keys. An authenticated caller who reaches a filter through an HTTP query parameter, a request body field or an agent tool argument can inject operators such as $regex or $where. Where the filter is the mechanism enforcing per-user or per-tenant isolation - the common pattern for a multi-tenant agent service - injected operators defeat the intended equality match and return other tenants' checkpoints and stored state, which is conversation history, tool traces and whatever the agent persisted. Deployments that build filters entirely from trusted server-side values are materially less exposed. The vendor split this across two packages with one advisory.

Who can reach it

An authenticated caller of the agent service who can influence a filter value - via an API parameter, a request body field, or a tool argument the model passes through. No MongoDB credentials needed.

What to do

Upgrade to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, then restart the agent or inference service that imports them. A dependency bump and daemon restart; no node action. If you cannot upgrade immediately, construct filters server-side only and reject any key beginning with $ before it reaches these calls.

References

Related entries

• SitemapLoader: nested sitemap entries skip restrict_to_same_domain, giving readable SSRFCVE-2026-72848 · langchain-community SitemapLoader (nested sitemap index entries)High
• JupyterLab: missing await skips extension allowlist check for direct PyPIExtensionManager callersCVE-2026-73626 · JupyterLab PyPIExtensionManager.install() (extension allowlist/blocklist enforcement)High
• Headroom LLM proxy: client-chosen upstream base URL enables SSRF and leaks the Authorization headerCVE-2026-77775 · Headroom LLM proxy (x-headroom-base-url upstream selection)High
• JupyterLab: XSS via untrusted notebook contentCVE-2024-43805 · JupyterLabHigh
• ONNX: Directory traversal via `external_data` field in the tensor protoCVE-2022-25882 · ONNXHigh
• Dagster (webserver): Directory traversalCVE-2023-51232 · Dagster (webserver)High