The Widespread Use Of AI Agent Tools Has Exposed Big System Weaknesses In LangGraph And LangChain
The wide use of AI agent tools, such as LangGraph and LangChain, has exposed big system weaknesses, which raises major concerns about langgraph langchain security Security. Attackers can take advantage of these flaws to access very sensitive data because of weak security levels within these systems. Researchers recently found basic coding errors in three popular AI agent tools, which allows attackers to gain total control over entire systems. These findings show how simple setup mistakes can give an attacker a direct shell to private keys and database information, underscoring the key need for strong langgraph langchain security.
Widespread Security Weaknesses In AI Frameworks
- Check Point Research identified a SQL injection weakness in LangGraph’s SQLite checkpointer, which they designated CVE-2025-67644. This weakness lets attackers run full remote code through a chained attack when the function that builds the WHERE clause accepts keys controlled by a user without proper checks. While this risk is not universal for all setups, it becomes Critical if an attacker can influence the input reaching the system’s history endpoint. Systems that self-host LangGraph using SQLite or Redis checkpointers become weak if untrusted input reaches the state history function that processes the data.
- A second weakness, CVE-2026-28277, permits LangGraph’s msgpack checkpoint decoder to import modules and run functions using arguments supplied by an attacker. To exploit this specific step, the attacker must have write access to the checkpoint store, which the initial SQL injection flaw can remotely provide. LangGraph processes this forged data as a valid checkpoint, helping the decoder run specific functions, including operating system commands. This shows how the system design creates a dangerous path for attackers to execute code using the agent server’s identity.
How Langflow And LangChain Core Flaws Create Backdoors
- Langflow currently faces active attacks because of a path traversal weakness, CVE-2026-5027, found within its file upload endpoint. This flaw lets an attacker directly use the filename from the form data and write it to the disk without sanitizing the input, representing a big coding error. Because Langflow defaults to auto-login, an exposed instance requires no credentials for an attacker to gain system access. VulnCheck confirmed the exploitation on June 9, successfully showing the weakness wrote test files onto victim systems.
- The scope of this finding is extensive, as 7,000 exposed Langflow instances were tracked globally, mainly in North America. This was the third Langflow issue to see live attacks this year, following the MuddyWater campaign against earlier software versions. Although the patch for CVE-2026-5027 was released on April 15, attacks began in June, leaving systems exposed for nearly two months. This timeline demands that security teams prioritize setting up the patch immediately upon the flaw’s announcement, rather than waiting for official alerts.
- LangChain-core also introduces risks through CVE-2026-34070, which features a path traversal weakness in its older prompt-loading API. This function reads a file path from a configuration dictionary without checking for traversal sequences, which is a serious coding error in the setup. An attacker influencing this path can read any file the server can access, including the secret .env file containing API keys like OPENAI_API_KEY. Cyera added to this risk with CVE-2025-68664, a deserialization flaw that lets attackers resolve environment secrets using a custom object. Addressing both issues is key, since the more severe flaw remains active even if the less severe one is patched.
Understanding LangGraph LangChain Security Risks
These three major tools exemplify three classic application security problems: path traversal, SQL injection, and unsafe deserialization. These are not new AI-specific problems, but rather established coding weaknesses embedded deeply within modern AI setups. This security gap exists within the “plumbing” layer where AI integrates with corporate business systems, which makes it a technical issue for all parties. Security experts note that these issues are challenging for typical scanning tools to detect because they do not appear as AI-specific risks. For related coverage, see tech coverage.
