Findings

CVE-2026-27794

LangGraph Checkpoint defines the base interface for LangGraph checkpointers.

Published Feb 25, 2026 · updated Jun 17, 2026

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from and opt nodes into caching via . Prior to 4.0.0, defaults to . When msgpack serialization fails, cached values can be deserialized via . Caching is not enabled by default. Applications are affected only when the application explicitly enables a cache backend (for example by passing to or otherwise configuring a implementation), one or more nodes opt into caching via , and the attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file). An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them. This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume). Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector. LangGraph Checkpoint 4.0.0 patches the issue.