PYSEC-2026-3636 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

SummaryThe Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

PYSEC-2026-3635 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

EUVD-2026-54476

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with / and extend the streamed...

CVE-2026-71433

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

GHSA-47PJ-3JCM-6WHG LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

Incorrect Authorization

Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Incorrect Authorization in the search or listnamespaces process. An attacker can access data from unintended namespaces by crafting...

CVE-2026-71433 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

CVE-2026-71433 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

CVE-2026-71433 LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

CVE-2026-71433

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

CVE-2026-71433

CVE-2026-71433 affects LangGraph checkpoint stores for Postgres and SQLite. Before 3.1.1, langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite persisted hierarchical namespaces as a dot-joined string and used a simple prefix match for reads, allowing an authenticated caller to access ite...

EUVD-2026-54227

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

RHSA-2026:50779 Red Hat Security Advisory: libpq security update

Bulletin has no description...

CVE-2026-71433: Exposure of Sensitive Information to an Unauthorized Actor

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...

PT-2026-68801

Name of the Vulnerable Software and Affected Versions langgraph-checkpoint-postgres versions prior to 3.1.1 langgraph-checkpoint-sqlite versions prior to 3.1.1 Description The Postgres and SQLite implementations of LangGraph's checkpoint saver persist hierarchical namespaces as dot-joined strings...

CVE-2026-71276 Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter

Magistrala formerly Mainflux's message-readers API reads a value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: and the TimescaleDB reader...

CVE-2026-71276

The CVE affects Magistrala (formerly Mainflux) – specifically the message-readers API. The HTTP endpoint reads a query parameter named format without validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go) and the T...

MAL-2026-12019 Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...