CVE-2026-55253

LangChain's MongoDB integrations for LangGraph (langgraph-checkpoint-mongodb and langgraph-store-mongodb) fail to recursively strip keys prefixed with "$" from filter dictionaries passed to MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search(), allowing NoSQL query operator injection. An authenticated attacker who can influence a filter argument — via HTTP query parameters, request body fields, or agent tool arguments — can inject MongoDB Query Language operators such as $regex or $where to bypass intended equality filters. In multi-tenant deployments where the filter enforces per-user or per-tenant isolation, this lets the attacker read other tenants' checkpoint or store data, which can include conversation state, memory, and other sensitive agent data. Applications that build filters entirely from trusted server-side values are at lower practical risk. The flaw is fixed in langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, and no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade to langgraph-checkpoint-mongodb 0.3.0 or later and langgraph-store-mongodb 0.4.0 or later. Audit your application for code paths where user-controlled input (HTTP query parameters, request bodies, or agent tool arguments) reaches a list(), alist(), or search() filter, especially where the filter implements tenant or user isolation. Until patched, recursively reject keys beginning with "$" in any filter built from untrusted input, and re-check stored data for cross-tenant access if multi-tenant filters were user-influenced.