Product by Langchain-ai
Langgraph
11 known vulnerabilities in Langgraph (Langchain-ai), 0 of them actively exploited (CISA KEV).
Key figures
11
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-28277 | LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading | 6.8 | |
| High | CVE-2025-67644 | Langchain-ai Langgraph: SQL Injection | 7.3 | |
| High | CVE-2025-64439 | LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer | — | |
| High | CVE-2026-104873 | LangGraph SDK custom auth silently ignores actions= on resource decorators | — | |
| Medium | CVE-2026-115883 | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores | — | |
| Medium | CVE-2026-118667 | Langchain-ai Langgraph: Path Traversal | 4.3 | |
| Medium | CVE-2026-71433 | LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores | 5.3 | |
| Medium | CVE-2026-48775 | LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading | 6.8 | |
| Medium | CVE-2026-115885 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | — | |
| High | CVE-2025-64104 | LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore | 7.3 | |
| Low | CVE-2026-14742 | langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash | 3.1 |