LangGraph flattened namespace tuples into colliding storage names

An agent can be correctly authenticated and still retrieve another user’s memory if storage converts structured namespace parts into an ambiguous string. LangGraph’s persistent backends used a dotted representation in which distinct tuples could map to one key. primary evidence separates the affected Postgres and SQLite stores from its unaffected in-memory implementation.

The advisory reports an authorization flaw and tested operations, not known exploitation of a hosted LangGraph tenant. Risk depends on an application relying on those namespaces as access-control boundaries.

Use collision-free tuple serialization and tenant checks for reads, searches, deletes and batches. A superficial escape rule is insufficient unless every producer and consumer shares it.

A persistent store cannot treat a tuple as an access-control key if concatenation loses tuple boundaries. A namespace such as (tenant, bob) collides with (tenant.bob) under dot joining. The advisory describes reads, searches and writes/deletes against the wrong namespace in the affected persistent adapters; it explicitly distinguishes unaffected in-memory stores. The serialization fix must be applied consistently at every storage and batch operation, and any application relying on namespaces as a tenant boundary should retest with colliding identities rather than trusting pre-patch stored keys.