Lang Graph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution
Summary: Check Point disclosed three now-patched flaws in LangGraph, the open-source LangChain framework for building stateful multi-agent AI applications, including a chain of CVE-2025-67644 and CVE-2026-28277 that researcher Yarden Porat said can achieve remote code execution. The chain is exploitable in self-hosted deployments using the SQLite or Redis checkpointer with user-controlled filter input, hinges on the application exposing the get_state_history() endpoint, and does not affect LangChain's managed LangSmith Deployment platform.
Key Takeaway: The maintainers describe CVE-2026-28277 as post-exploitation: an attacker who can write checkpoint data can turn it into code execution in the application runtime, exposing runtime secrets or reaching other systems that runtime can access. That puts the checkpoint store, not just the agent's prompt surface, inside the blast radius for anyone running LangGraph themselves.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-67644CVE-2026-28277
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026