LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution

# Critical LangGraph Flaw Chain Enables Remote Code Execution in Self-Hosted AI Agents

## The Threat

Security researchers have uncovered a dangerous vulnerability chain affecting LangGraph, an open-source framework developed by LangChain for building complex, stateful multi-agent AI applications. The flaw allows attackers to achieve complete remote code execution on self-hosted LangGraph deployments by exploiting a combination of SQL injection and unsafe deserialization weaknesses.

The vulnerability chain is particularly concerning because it demonstrates how classic security flaws—thought to be well-understood and mitigated in traditional software—can resurface with heightened impact when embedded in modern AI frameworks that operate with elevated privileges and broad system access. An attacker with access to a vulnerable endpoint can systematically manipulate the application's state management layer to inject and execute arbitrary code, potentially gaining full control of the underlying server and any systems it can reach.

The flaw affects self-hosted deployments using either SQLite or Redis as checkpoint storage mechanisms. Critically, this does not affect LangSmith Deployment, LangChain's managed cloud platform, where the isolation and access controls prevent such exploitation. However, organizations running their own LangGraph instances—a common pattern for security-conscious teams wanting to keep sensitive data on-premises—face immediate risk if they haven't applied the latest patches.

## Severity and Impact

| Aspect | Details |

|--------|---------|

| Primary CVE | CVE-2025-67644, CVE-2026-28277 (chained) |

| CVSS Scores | 7.3 (SQL Injection), 6.8 (Deserialization) |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Unchanged |

| Impact | Complete remote code execution (RCE) |

| Secondary CVE | CVE-2026-27022 (CVSS 6.5 - Query Injection) |

The exploit chain hinges on exploiting the get_state_history() endpoint, which many deployments expose to retrieve historical checkpoint data. The attack unfolds in four distinct steps: first, the attacker crafts a malicious msgpack payload containing instructions for arbitrary code execution; second, they send a specially crafted filter parameter that leverages the SQL injection vulnerability to return a fake checkpoint row with attacker-controlled serialized data; third, when the application processes these results, it deserializes the checkpoint BLOB; and finally, the unsafe deserialization flaw executes the attacker's payload with full runtime privileges.

## Affected Products

LangGraph Components:

Vulnerable Configurations:

Not Affected:

## Mitigations

Organizations running self-hosted LangGraph instances should implement the following measures immediately:

Immediate Actions:

Access Controls:

Operational Security:

Monitoring:

## References

## HackWire Analysis

This vulnerability chain illustrates a critical inflection point in AI security: the convergence of legacy software vulnerabilities with the elevated privileges afforded to modern AI agents. SQL injection has been understood since the 1990s, and unsafe deserialization since the mid-2000s—yet their combination in an AI orchestration framework creates a uniquely dangerous exploit path.

The key insight is that LangGraph applications often operate as highly privileged identity holders, with broad access to databases, APIs, internal systems, and sometimes sensitive business logic. When a security flaw allows an attacker to break out of the application sandbox and execute code at runtime, the blast radius extends far beyond the agent itself. An attacker gains not just access to the checkpoint store, but potentially to secrets embedded in the runtime, connected data sources, and downstream systems the agent can reach.

What's particularly concerning is the self-hosted adoption pattern. Teams deploying LangGraph on-premises often do so because they handle sensitive data or operate in regulated environments where cloud solutions are not viable. However, self-hosted deployments typically receive less security hardening than managed platforms—there's no built-in isolation, fewer enforcement guardrails, and a greater dependency on the deploying organization's operational security maturity. This creates a paradox: the teams most motivated to avoid cloud platforms may be least equipped to defend self-hosted AI infrastructure.

The discovery also reveals a blind spot in how the AI community thinks about security. AI frameworks are rapidly maturing, but security practices often lag behind. Teams racing to integrate agents into production systems may not be applying the same hardening disciplines—input validation, parameterized queries, safe deserialization patterns—that would be automatic in traditional backend development. This vulnerability should serve as a wake-up call: AI frameworks are not magic; they're software, and they require rigorous security controls.

Organizations deploying LangGraph self-hosted should view this not just as a patch to apply, but as a forcing function to audit their entire AI agent security posture. Secrets management, network segmentation, access controls, and monitoring around AI infrastructure deserve the same investment and discipline as any other critical system. — HackWire Editorial

## Related Coverage