CVE-2026-55405: LangChain4j SQL Injection Vulnerability

CVE-2026-55405 Overview

CVE-2026-55405 is a SQL injection vulnerability in LangChain4j, a Java library for building large language model (LLM) applications on the JVM. The flaw affects the langchain4j-mariadb and langchain4j-pgvector embedding stores. These modules construct metadata-filter SQL by string-concatenating filter keys, and MariaDB string values, directly into queries without adequate escaping. An attacker who controls a metadata key in EmbeddingSearchRequest.filter() can break out of the SQL context and inject arbitrary statements. The issue is fixed in versions 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26.

Critical Impact
Attackers can perform blind data exfiltration, trigger denial of service through sleep functions, and delete arbitrary rows via removeAll(Filter) operations against MariaDB and pgvector embedding stores.

Affected Products

LangChain4j langchain4j-mariadb prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26
LangChain4j langchain4j-pgvector prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26
Java applications on the JVM integrating LangChain4j embedding stores with untrusted metadata keys

Discovery Timeline

2026-07-10 - CVE-2026-55405 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55405

Vulnerability Analysis

The vulnerability is a classic SQL Injection [CWE-89] in the metadata-filter builders of two embedding store modules. Both ColumnFilterMapper and JSONFilterMapper in the MariaDB integration concatenate caller-supplied metadata keys directly into the generated SQL. The pgvector integration exhibits the same class of issue. When applications forward user-controlled or LLM-generated metadata keys into EmbeddingSearchRequest.filter(), the attacker gains control over parts of the query text that are executed by the underlying JDBC driver.

Exploitation supports blind data exfiltration through boolean or time-based side channels. Injected sleep() calls cause denial of service against the backing database. Because removeAll(Filter) shares the same builder, an attacker can also delete arbitrary rows by manipulating the WHERE clause.

Root Cause

The root cause is unsafe identifier and value construction. In JSONFilterMapper, keys were embedded into a JSON path fragment with no escaping. In ColumnFilterMapper, the previous implementation relied on Driver.enquoteIdentifier but silently fell back to the raw key on SQLException, breaking the escaping contract.

Attack Vector

The attacker supplies a crafted metadata key to any code path that reaches EmbeddingSearchRequest.filter() on a vulnerable MariaDB or pgvector embedding store. Because retrieval-augmented generation (RAG) pipelines often build filters from LLM tool output, chat parameters, or upstream services, the network attack surface is broad and requires only low privileges.

java

// Source: https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219
// Patch: langchain4j-mariadb/.../ColumnFilterMapper.java
 package dev.langchain4j.store.embedding.mariadb;

-import java.sql.SQLException;
-import org.mariadb.jdbc.Driver;
-
 class ColumnFilterMapper extends MariaDbFilterMapper {

     String formatKey(String key) {
-        try {
-            return Driver.enquoteIdentifier(key, true);
-        } catch (SQLException e) {
-            return key;
-        }
+        return MariaDbValidator.validateAndEnquoteIdentifier(key, true);
     }
 }

java

// Source: https://github.com/langchain4j/langchain4j/commit/13a0698bdfaf105d8aaf0367881df51358596219
// Patch: langchain4j-mariadb/.../JSONFilterMapper.java
     String formatKey(String key) {
-        return "JSON_VALUE(" + this.metadataColumn + ", '$." + key + "')";
+        String escapedKey = key.replace("\\", "\\\\").replace("'", "''");
+        return "JSON_VALUE(" + this.metadataColumn + ", '$." + escapedKey + "')";
     }

The fixes replace the silent fallback with a strict validator (MariaDbValidator.validateAndEnquoteIdentifier) and escape backslashes and single quotes in JSON path keys.

Detection Methods for CVE-2026-55405

Indicators of Compromise

Database query logs containing metadata-filter SQL with unexpected characters such as ', --, ;, or " inside JSON path expressions like JSON_VALUE(..., '$.<key>').
Long-running queries against embedding store tables that include SLEEP(, pg_sleep(, or BENCHMARK( calls.
Unexpected DELETE operations or row-count drops in tables backing langchain4j-mariadb or langchain4j-pgvector stores.
Application logs showing metadata keys containing SQL operators, quotes, or whitespace not conforming to the schema's allowed key format.

Detection Strategies

Enable database query logging on MariaDB and PostgreSQL backends and alert on queries referencing the embedding store schema that contain SQL metacharacters in identifier or JSON path positions.
Instrument LangChain4j applications to log the raw metadata keys passed to EmbeddingSearchRequest.filter() and flag keys that fail a strict [A-Za-z0-9_]+ allowlist.
Correlate spikes in database CPU or connection wait time with retrieval endpoints that accept user-supplied filter parameters.

Monitoring Recommendations

Monitor removeAll(Filter) invocation frequency and alert on volumes that exceed baseline usage.
Track database error rates for syntax errors originating from the embedding store connection pool, which often accompany injection probing.
Review dependency inventories for vulnerable langchain4j-mariadb and langchain4j-pgvector versions using software composition analysis (SCA) tooling.

How to Mitigate CVE-2026-55405

Immediate Actions Required

Upgrade langchain4j-mariadb and langchain4j-pgvector to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, or 1.16.3-beta26, matching your release line.
Audit all application code paths that pass user- or LLM-controlled data into EmbeddingSearchRequest.filter() and enforce a strict allowlist on metadata keys.
Restrict database credentials used by the embedding store to the minimum privileges required, avoiding DELETE or DROP where possible.

Patch Information

Fixes are published in GitHub Security Advisory GHSA-2mfg-cc43-9pcj and shipped in LangChain4j release 1.16.3. The patches introduce identifier validation via MariaDbValidator.validateAndEnquoteIdentifier and add escaping for backslash and single-quote characters in JSON path keys. See the ColumnFilterMapper fix commit for reference.

Workarounds

Reject metadata keys that do not match a strict [A-Za-z0-9_]+ pattern before invoking any embedding store filter API.
Do not construct Filter objects from LLM tool output or untrusted HTTP parameters without validation and canonicalization.
Deploy database-level statement filtering or read-only accounts for retrieval workflows that do not require removeAll(Filter).

bash

# Update Maven dependency to a patched release
mvn versions:use-dep-version \
  -Dincludes=dev.langchain4j:langchain4j-mariadb \
  -DdepVersion=1.16.3-beta26 -DforceVersion=true

mvn versions:use-dep-version \
  -Dincludes=dev.langchain4j:langchain4j-pgvector \
  -DdepVersion=1.16.3-beta26 -DforceVersion=true