EXECUTIVE SUMMARY:
CVE-2026-55253 with a CVSS score of 7.7 is a NoSQL injection issue in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries, specifically affecting the MongoDBSaver.list method, which accepts a filter parameter that is incorporated into MongoDB queries without sufficient validation. The vulnerability allows a caller with control of the filter input to embed MongoDB query operators directly into the query, leading to cross-tenant data exposure through remote API access with low complexity, requiring an authenticated caller of the checkpoint/store API without user interaction. Successful exploitation can result in full access to other tenants' checkpoint data with read-only access and no service disruption. The issue impacts applications using langgraph-checkpoint-mongodb or langgraph-store-mongodb that call MongoDBSaver.list, MongoDBSaver.alist, or MongoDBStore.search with filter arguments derived from user-controlled input in multi-tenant environments where filters are used for per-user or per-tenant data isolation. Organizations should upgrade to the latest versions of the affected libraries or apply mitigations by removing or escaping MongoDB query metacharacters such as "$" before passing user-controlled input to the filter parameter.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-55253 with a CVSS score of 7.7 is a NoSQL injection issue in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries, specifically affecting the MongoDBSaver.list method, which accepts a filter parameter that is incorporated into MongoDB queries without sufficient validation. The vulnerability allows a caller with control of the filter input to embed MongoDB query operators directly into the query, leading to cross-tenant data exposure through remote API access with low complexity, requiring an authenticated caller of the checkpoint/store API without user interaction. Successful exploitation can result in full access to other tenants' checkpoint data with read-only access and no service disruption. The issue impacts applications using langgraph-checkpoint-mongodb or langgraph-store-mongodb that call MongoDBSaver.list, MongoDBSaver.alist, or MongoDBStore.search with filter arguments derived from user-controlled input in multi-tenant environments where filters are used for per-user or per-tenant data isolation. Organizations should upgrade to the latest versions of the affected libraries or apply mitigations by removing or escaping MongoDB query metacharacters such as "$" before passing user-controlled input to the filter parameter.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-533j-2v4q-mw5h
[/emaillocker]