CVE-2026-55253: LangChain MongoDB Auth Bypass Vulnerability

CVE-2026-55253 Overview

CVE-2026-55253 is a NoSQL injection vulnerability in the LangChain MongoDB integration libraries. The flaw affects langgraph-checkpoint-mongodb prior to version 0.3.0 and langgraph-store-mongodb prior to version 0.4.0. The MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods incorporate filter dictionaries into MongoDB queries without recursively rejecting keys prefixed with $. An authenticated caller who controls a filter argument through HTTP query parameters, request body fields, or agent tool arguments can inject MongoDB Query Language (MQL) operators such as $regex or $where. The weakness is classified under [CWE-943].

Critical Impact
In multi-tenant deployments that rely on filter dictionaries to enforce per-user or per-tenant isolation, injected MQL operators can bypass equality filtering and expose other tenants' checkpoint or store data.

Affected Products

langgraph-checkpoint-mongodb prior to 0.3.0
langgraph-store-mongodb prior to 0.4.0
LangChain MongoDB integrations for LangGraph agent workflows

Discovery Timeline

2026-09-14 - CVE-2026-55253 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55253

Vulnerability Analysis

The LangChain MongoDB integration exposes agent state persistence and long-term memory stores backed by MongoDB. Callers pass a filter dictionary to narrow results, typically keyed on tenant or user identifiers. The library forwarded these dictionaries directly into MongoDB queries without recursively scanning for operator keys. MongoDB treats any key beginning with $ as an operator, meaning a caller who supplies {"tenant_id": {"$ne": "other"}} inverts the intended equality check. Operators such as $regex, $where, and $gt can be used to enumerate documents across tenants or coerce broader matches than the application intended.

Root Cause

The root cause is missing input validation of nested dictionary keys before passing filters to the MongoDB driver [CWE-943, Improper Neutralization of Special Elements in Data Query Logic]. The pre-patch code paths in saver.py and base.py accepted arbitrary dictionary structures. There was no recursive check that rejected keys starting with $ or that constrained filter values to scalar types.

Attack Vector

Exploitation requires an authenticated caller who controls at least part of the filter argument. Typical delivery paths include HTTP query parameters, JSON request body fields, and agent tool arguments generated from user prompts. Filters constructed entirely from trusted server-side values carry lower practical risk. In multi-tenant LangGraph deployments, an attacker can bypass tenant isolation and read checkpoint state or store entries belonging to other tenants.

python

# Security patch: recursive validation added to utils.py
def _validate_filter(filter_dict: dict[str, Any]) -> None:
    for key, value in filter_dict.items():
        if not isinstance(key, str) or key.startswith("$"):
            raise ValueError(
                f"Invalid filter key '{key}': MongoDB operator keys are not allowed."
            )
        if isinstance(value, dict):
            _validate_filter(value)

Source: GitHub Commit 14a6cc3

python

# Security patch in langgraph-store-mongodb base.py
if filter:
    if any(f.startswith("value") for f in filter):
        raise ValueError("filters should be specified without `value`")
    if any(isinstance(v, dict) for v in filter.values()):
        raise ValueError(
            "filter values must be scalars (str, int, float, bool, None); "
            "dict values allow MQL operator injection"
        )

Source: GitHub Commit 5465e4d

Detection Methods for CVE-2026-55253

Indicators of Compromise

Application logs showing filter dictionaries containing keys prefixed with $ such as $ne, $regex, $where, $gt, or $in.
MongoDB slow-query or profiler entries referencing collections used by MongoDBSaver or MongoDBStore with unexpected operator-based match stages.
Agent tool invocations where user-controlled input produces filter arguments containing nested dictionaries.

Detection Strategies

Instrument LangGraph applications to log the exact filter passed to MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() and alert on operator keys.
Enable MongoDB database profiling on checkpoint and store collections and search aggregation pipelines for $where or $regex on tenant-scoped fields.
Review dependency manifests for pinned versions of langgraph-checkpoint-mongodb below 0.3.0 and langgraph-store-mongodb below 0.4.0.

Monitoring Recommendations

Correlate authenticated user sessions with the tenant identifiers returned from checkpoint or store queries and flag cross-tenant reads.
Track anomalous spikes in query result cardinality against per-tenant baselines.
Ingest MongoDB audit logs into a centralized analytics platform to retain forensic evidence of filter injection attempts.

How to Mitigate CVE-2026-55253

Immediate Actions Required

Upgrade langgraph-checkpoint-mongodb to 0.3.0 or later and langgraph-store-mongodb to 0.4.0 or later.
Audit application code paths that build filter dictionaries from untrusted input, including HTTP parameters and agent tool arguments.
Restrict database credentials used by LangGraph services to least-privilege roles scoped to specific collections.

Patch Information

The vendor released fixes in langgraph-checkpoint-mongodb v0.4.0 and langgraph-store-mongodb v0.3.0. The changes are tracked in Pull Request #384 and detailed in GHSA-533j-2v4q-mw5h. The patches introduce _validate_filter() to recursively reject keys starting with $ and to constrain store filter values to scalar types.

Workarounds

Construct filter dictionaries exclusively from trusted server-side values and never merge caller-supplied dictionaries directly.
Validate all inbound filter payloads to ensure keys are strings that do not begin with $ and that values are scalar types.
Wrap calls to MongoDBSaver and MongoDBStore in a helper that enforces per-tenant equality on a server-side field before executing.

bash

# Upgrade the affected packages
pip install --upgrade "langgraph-checkpoint-mongodb>=0.3.0" \
                      "langgraph-store-mongodb>=0.4.0"

# Verify installed versions
pip show langgraph-checkpoint-mongodb | grep -i version
pip show langgraph-store-mongodb | grep -i version