LangGraph serialized tuple elements into one dot-delimited text key for its Postgres and SQLite checkpoint stores. That mapping was non-injective: a tuple containing the literal label tenant.bob could resolve to the namespace otherwise represented by the two labels tenant and bob. Write validation blocked dots in the normal put call, but getters, searches,…
Inspect the ClaimsCase · DiggingBeagle record
LangGraph dotted namespace serialization crossed tenant store boundaries
Two LangGraph checkpoint stores serialized namespaces with dot separators but checked dot-containing labels only on some code paths; a crafted tuple could alias another tenant namespace for reads and writes.
Scope
langgraph-checkpoint-postgres earlier than 3.1.3 and langgraph-checkpoint-sqlite earlier than 3.1.2, when untrusted input can supply namespace labels to get/search/delete/batch; in-memory store not affected.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade A
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
CASE-2026-LANGGRAPH-DOTTED-NAMESPACE-ALIAS: GHSA-6hmw-9432-67qq shows that Postgres and SQLite stores map ("tenant", "bob") and ("tenant.bob",) to the same persisted namespace and patched different versions 3.1.3 and 3.1.2 respectively. Evidence comes from SRC-2026-LANGGRAPH-NAMESPACE-GHSA. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LANGGRAPH-TENANT-ALIAS · LangGraph GHSA-6hmw-9432-67qq tuple namespace collision
At a glance
Tenant state isolation must be defined at the canonical storage key, not merely in the convenient tuple representation used by calling code. The in-memory backend kept tuple identity and was not affected; blanket claims about every LangGraph deployment would be incorrect.
Read the implicationsThe GitHub advisory does not establish production compromise of any specific tenant.
Limits and uncertaintyFull account
LangGraph serialized tuple elements into one dot-delimited text key for its Postgres and SQLite checkpoint stores. That mapping was non-injective: a tuple containing the literal label tenant.bob could resolve to the namespace otherwise represented by the two labels tenant and bob. Write validation blocked dots in the normal put call, but getters, searches, deletions and batch operations missed equivalent checks. The advisory illustrates cross-tenant reads, overwrites and deletion when a lower-trust caller controls namespace labels, with exposure conditional on application routing. Postgres 3.1.3 and SQLite 3.1.2, using base checkpoint 4.3.0 validation, address the collision. The in-memory implementation compares tuples rather than serialized text, so is unaffected. This is an agent-memory tenant-boundary failure at the persistence adapter, not a generic vulnerability in every LangGraph deployment.
This is an identity-canonicalization failure in an agent memory store, not a prompt-injection incident. The dangerous action occurs when the storage representation can treat distinct tenant namespace tuples as equivalent after serialization. Once a namespace aliases another, a query may read or write data under an authority boundary that the caller did not possess. A regression test should use adversarial tenant tuples that differ before serialization but collide afterward, and check both reads and writes. The advisory establishes the vulnerable transformation; it does not provide a count of affected production tenants. LangGraph advisory.
Mechanism and trust boundary
- 01
Represent tenant scope as a tuple
One application models isolation as labels such as (tenant, bob) in its checkpoint or memory store.
Boundary: Tenant label tuple / logical isolation key
- 02
Flatten the tuple into an ambiguous string
Postgres and SQLite backends joined labels with dots, so two different tuples produced the same persisted namespace.
Boundary: Structured namespace identity / dot-delimited key
- 03
Use an unchecked lookup or batch mutation
A caller controlling a dotted label could access or alter another namespace through reads, deletes or batch operations despite validation on normal writes.
Boundary: Untrusted namespace selection / persistent agent memory
Timeline
- 2026-10 (month precision)Event type unspecified
LangGraph namespace collision advisory
Upstream developers documented tuple-namespace ambiguity and a fixed scoped-storage implementation.
- Oct 21, 2026disclosure
Public disclosure
Claims & evidence
CLM-LANGGRAPH-ENRICH-FIXMaintainers list fixed releases langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.supported
Basis: reported finding
- supportsLangGraph GHSA-6hmw-9432-67qq tuple namespace collisionprimary disclosure
Affected and patched versions
CLM-LANGGRAPH-TENANT-ALIASGHSA-6hmw-9432-67qq shows that Postgres and SQLite stores map ("tenant", "bob") and ("tenant.bob",) to the same persisted namespace and patched different versions 3.1.3 and 3.1.2 respectively.supported
Basis: reported finding
- supportsLangGraph GHSA-6hmw-9432-67qq tuple namespace collisionprimary disclosure
Summary; Details; Impact; Remediation
CLM-LANGGRAPH-ENRICH-COLLISIONThe advisory demonstrates that ("tenant.bob",) and ("tenant", "bob") collided in Postgres/SQLite serialization, with unchecked get, search, delete and batch routes; InMemoryStore was not affected.supported
Basis: reported finding
- supportsLangGraph GHSA-6hmw-9432-67qq tuple namespace collisionprimary disclosure
Summary; Details; Impact
Implications
Tenant state isolation must be defined at the canonical storage key, not merely in the convenient tuple representation used by calling code. The in-memory backend kept tuple identity and was not affected; blanket claims about every LangGraph deployment would be incorrect.
Controls and mitigations
- Upgrade langgraph-checkpoint-postgres to 3.1.3 and sqlite to 3.1.2. Apply namespace validation consistently to get, search, delete, batch and async variants, and bind tenant context at the service boundary.
Unknowns and contradictions
- The GitHub advisory does not establish production compromise of any specific tenant.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188