product · DiggingBeagle record
LangGraph agent execution and persistent Store
LangGraph includes agent state, persistence and Store APIs with language-specific authorization handlers. Store request rewriting and serialized namespace collisions are separate failure mechanisms despite sharing a tenant-isolation theme.
- Entity kind
- product
Record description
LangGraph provides persistent agent state and Store namespaces. Two independently disclosed isolation defects should not be merged: delimiter-based namespace serialization can alias distinct tenant identities, while CVE-2026-118668 concerns JavaScript/TypeScript custom authorization handlers whose namespace rewrites did not survive the runtime boundary. The latter requires affected langgraph-api versions, a rewriting handler and authenticated access; Python handlers and rejecting handlers are separate cases. A deployment may need both canonical serialization and effect-time authorization.