CVE-2026-28277: LangGraph SQLite Checkpoint RCE Flaw

CVE-2026-28277 Overview

CVE-2026-28277 is an insecure deserialization vulnerability affecting LangGraph SQLite Checkpoint, an implementation of LangGraph CheckpointSaver that uses SQLite DB for both synchronous and asynchronous operations via aiosqlite. In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privileged write access to the persistence layer), they can potentially supply a crafted payload that triggers unsafe object reconstruction when the checkpoint is loaded.

Critical Impact

Attackers with write access to the checkpoint persistence layer can inject malicious payloads that execute arbitrary code when checkpoints are deserialized, potentially leading to complete system compromise.

Affected Products

• LangGraph SQLite Checkpoint version 1.0.9 and prior
• LangGraph checkpointers using msgpack-encoded checkpoints
• Applications using aiosqlite-based checkpoint persistence

Discovery Timeline

• 2026-03-05 - CVE-2026-28277 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28277

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a well-known class of security flaws that can lead to severe consequences including remote code execution. The core issue lies in how LangGraph's checkpoint mechanism handles msgpack-encoded data when reconstructing Python objects.

Msgpack is a binary serialization format that, when combined with extension types for Python object serialization, can allow arbitrary object instantiation during deserialization. The LangGraph checkpointer does not appear to implement sufficient safeguards to prevent malicious payloads from triggering unsafe object reconstruction.

The vulnerability requires an attacker to have privileged write access to the checkpoint persistence layer, which could be achieved through database compromise, SQL injection in another application sharing the same database, or insider threat scenarios.

Root Cause

The root cause stems from the unsafe deserialization of msgpack-encoded checkpoint data without proper validation or sandboxing. When checkpoints are loaded from the SQLite backing store, the deserialization process reconstructs Python objects based on the encoded data. This pattern is inherently dangerous when the data source cannot be fully trusted, as malicious actors can craft payloads that instantiate dangerous objects or trigger code execution during the unpickling process.

Attack Vector

The attack requires adjacent network access with high privileges, as indicated by the CVSS vector. An attacker must first compromise or gain write access to the checkpoint database. Once they have this access, they can inject a specially crafted msgpack payload into the checkpoint data. When a legitimate application loads this corrupted checkpoint, the malicious payload is deserialized, potentially executing arbitrary Python code within the application's context.

The attack flow involves:

1. Attacker compromises the checkpoint persistence layer (SQLite database)
2. Attacker modifies checkpoint data with a malicious msgpack payload containing serialized Python objects
3. Application loads the compromised checkpoint
4. Unsafe deserialization triggers object reconstruction
5. Malicious code executes with application privileges

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28277

Indicators of Compromise

• Unexpected modifications to checkpoint data in the SQLite database
• Anomalous database write operations from unauthorized sources
• Unusual process spawning or network connections following checkpoint load operations
• Evidence of database compromise or unauthorized access attempts

Detection Strategies

• Implement integrity monitoring on checkpoint database files to detect unauthorized modifications
• Monitor database access logs for suspicious write operations to checkpoint tables
• Deploy application-level logging to track checkpoint load operations and detect anomalies
• Use behavioral analysis to identify unusual process activity following deserialization events

Monitoring Recommendations

• Enable audit logging on SQLite database access and modifications
• Implement checksum or cryptographic signature validation for checkpoint data
• Monitor for privilege escalation attempts that could lead to database compromise
• Set up alerts for unexpected changes to checkpoint table schemas or data patterns

How to Mitigate CVE-2026-28277

Immediate Actions Required

• Audit and restrict access to the checkpoint persistence layer (SQLite database)
• Implement database access controls to limit write permissions to trusted processes only
• Review and monitor all systems with write access to checkpoint storage
• Consider implementing additional authentication mechanisms for checkpoint operations

Patch Information

No known patch is publicly available at this time. Organizations should monitor the GitHub Security Advisory for updates on remediation options.

Workarounds

• Isolate the checkpoint database from network-accessible systems to reduce attack surface
• Implement cryptographic signing of checkpoint data to detect tampering
• Deploy database-level integrity monitoring and alerting
• Consider using read-only replicas for checkpoint loading operations where feasible
• Restrict network access to systems hosting checkpoint databases using firewall rules

# Example: Restrict SQLite database file permissions
chmod 600 /path/to/checkpoint.db
chown app_user:app_group /path/to/checkpoint.db

# Enable write-ahead logging for audit purposes
sqlite3 /path/to/checkpoint.db "PRAGMA journal_mode=WAL;"