CVE-2026-48121 Overview
CVE-2026-48121 is a NoSQL injection vulnerability in @langchain/langgraph-checkpoint-mongodb, a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below pass checkpoint identifiers from config.configurable into MongoDB find() queries without type enforcement. An attacker who supplies an object payload containing MongoDB operators such as $gt or $ne can bypass thread scoping. This allows checkpoint data, including pending writes, to leak across tenants in multi-tenant deployments. The maintainers released version 1.3.1 to remediate the flaw [CWE-943].
Critical Impact
Cross-tenant disclosure of LangGraph checkpoint data through MongoDB operator injection, breaking thread isolation in multi-tenant applications.
Affected Products
- @langchain/langgraph-checkpoint-mongodb versions 1.3.0 and below
- LangGraph.js applications using MongoDBSaver.getTuple() with untrusted config.configurable input
- Multi-tenant or user-isolated deployments forwarding untrusted request data into checkpoint identifiers
Discovery Timeline
- 2026-08-04 - CVE-2026-48121 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-48121
Vulnerability Analysis
The flaw resides in MongoDBSaver.getTuple(), which reads thread_id, checkpoint_ns, and checkpoint_id from config.configurable and forwards them directly into a MongoDB find() query. MongoDB's query language interprets objects containing keys prefixed with $ as query operators rather than literal values. Because the checkpoint saver does not coerce these identifiers to strings or validate them against a schema, an attacker can submit an object such as { "$ne": null } in place of a string identifier.
When the crafted object reaches the query builder, MongoDB matches checkpoints belonging to other threads and tenants. The result is unauthorized disclosure of checkpoint state, including pending writes that may contain conversation history, tool outputs, or agent memory belonging to other users.
Applications that only use server-issued, string-typed identifiers and reject non-string fields through schema validation are not affected. Risk concentrates in deployments that accept identifier values from HTTP request bodies, WebSocket frames, or client SDKs without normalization.
Root Cause
The root cause is missing input type enforcement on checkpoint identifiers before they are used in a NoSQL query, classified as improper neutralization of special elements in a data query language [CWE-943]. The checkpoint saver trusted callers to supply strings and never validated the runtime type of configurable fields.
Attack Vector
An authenticated user on an adjacent network sends a request that populates config.configurable.thread_id (or checkpoint_ns / checkpoint_id) with a JSON object containing MongoDB operators. The malicious object is passed unchanged into getTuple(), which issues a find() that matches documents across thread boundaries. The attacker retrieves checkpoint tuples and pending writes belonging to other tenants. Exploitation requires user interaction with the LangGraph application and low privileges, but no elevated MongoDB permissions.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-98xf-r82g-9mhx and the GitHub Issue Discussion.
Detection Methods for CVE-2026-48121
Indicators of Compromise
- Application logs showing config.configurable fields with non-string types, particularly objects whose keys begin with $.
- MongoDB query logs containing operators such as $ne, $gt, $in, or $regex inside thread_id, checkpoint_ns, or checkpoint_id filters.
- Unexpected access patterns where a single session reads checkpoint documents associated with multiple tenant identifiers.
Detection Strategies
- Enable MongoDB profiler or slow query logs and search for query documents where checkpoint identifier fields contain nested objects instead of scalar strings.
- Instrument the LangGraph application to log the typeof each config.configurable field before invoking MongoDBSaver.getTuple().
- Correlate authenticated session identifiers with the set of thread_id values returned from checkpoint reads to surface cross-tenant access.
Monitoring Recommendations
- Alert on any inbound HTTP or WebSocket payload where fields destined for config.configurable are JSON objects rather than primitives.
- Track the version of @langchain/langgraph-checkpoint-mongodb deployed across environments and flag any instance at or below 1.3.0.
- Monitor MongoDB audit events for find operations against checkpoint collections that return documents matching multiple tenant scopes.
How to Mitigate CVE-2026-48121
Immediate Actions Required
- Upgrade @langchain/langgraph-checkpoint-mongodb to version 1.3.1 or later across all environments.
- Audit application code paths that populate config.configurable and enforce string coercion or schema validation on thread_id, checkpoint_ns, and checkpoint_id.
- Review MongoDB checkpoint collections for evidence of cross-tenant reads since the vulnerable version was deployed.
Patch Information
The issue is fixed in @langchain/langgraph-checkpoint-mongodb version 1.3.1. See the remediating commit at langgraphjs commit 284226c and the GitHub Security Advisory GHSA-98xf-r82g-9mhx for full remediation details.
Workarounds
- Reject any request where config.configurable fields are not primitive strings using a schema validator such as Zod or JSON Schema.
- Coerce identifiers with String(value) before passing them into the checkpoint saver, and refuse values containing keys prefixed with $.
- Restrict LangGraph endpoints so identifiers are issued server-side and never accepted directly from clients in multi-tenant deployments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
