LangGraph Checkpoints, Not Agents, Are the Weak Link
Self-hosted LangGraph deployments can be pushed from state lookup into code execution through the checkpoint store. The break is not the agent’s reasoning loop. It is the persistence layer that reloads stored history as trusted objects, so a bad checkpoint can become executable input.
Check Point says three patched flaws chain in self-hosted SQLite and Redis checkpointers: CVE-2025-67644 in langgraph-checkpoint-sqlite before 3.0.1, CVE-2026-28277 in langgraph before 1.0.10, and CVE-2026-27022 in @langchain/langgraph-checkpoint-redis before 1.0.1. LangChain’s managed LangSmith Deployment is not affected. The exposed pattern is any app that lets user-controlled filters reach checkpoint history and then reloads that state as structured data.
The practical risk is broader than one CVE set. Any self-hosted agent backend that treats stored state as a trust boundary can turn a query into a code-loading path once an attacker can influence what gets written back and re-read.