langgraph-checkpoint-postgres

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Summary

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace.

Details

BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on unchecked, and batch/abatch checked nothing, including the PutOp items inside them. PostgresStore, AsyncPostgresStore, SqliteStore and AsyncSqliteStore turn a namespace into text with ".".join(namespace), so a label containing . resolved to the namespace whose labels it spells out:

• get(("tenant.bob",), key), search(("tenant.bob",)) and list_namespaces(prefix=("tenant.bob",)) returned data stored under ("tenant", "bob").
• delete(("tenant.alice",), key) deleted the item stored under ("tenant", "alice").
• batch([PutOp(("tenant.bob",), key, value)]) overwrote the item stored under ("tenant", "bob").

All releases of langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2 are affected. InMemoryStore compares namespaces as tuples and is not affected.

Impact

You may be affected if you use one of these stores, rely on namespaces to keep users or tenants apart, and let untrusted input choose a namespace label that reaches a read, delete or batch call. Such input could read, overwrite or delete another tenant's items. Labels written through put could never contain ., so no stored data becomes unreachable after upgrading.

LangSmith Deployment: the HTTP store API already rejected such labels, but store calls made from graph code reached the same flaw. The Agent Server rejects these labels from versions 0.15.5 and 0.16.2. On LangSmith Cloud, new deployments and revisions already include the fix and existing deployments get it on their next revision; self-hosted deployments should upgrade.

Remediation

Upgrade to langgraph-checkpoint-postgres 3.1.3 or langgraph-checkpoint-sqlite 3.1.2. Both require langgraph-checkpoint 4.3.0, where get, search, delete and list_namespaces reject labels that are empty, are not strings, or contain . with InvalidNamespaceError, and the Postgres and SQLite stores apply the same check to every op passed to batch/abatch. Stores outside this repository that turn namespaces into delimited text can call langgraph.store.base.validate_op_namespace for each op they run.

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
• No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

• Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
• Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.