LangGraph's Postgres and SQLite stores, often used for agents' long-term memory, saved a namespace as its labels joined with .. So ("tenant", "bob") and ("tenant.bob",) pointed to the same data. Only put rejected dots. get, search, delete, list_namespaces and batch calls did not.

• Impact: if untrusted input (a user ID, or a value an agent picks) chooses a namespace label, a caller could read, overwrite or delete another user's or tenant's stored memories.
• Fixed: langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2 (both need langgraph-checkpoint 4.3.0). The Agent Server rejects such labels from 0.15.5 / 0.16.2. LangSmith Cloud deployments get the fix on their next revision; self-hosted deployments need to upgrade. InMemoryStore is not affected.

Lesson for any agent memory layer: build tenant keys from server-side identity, never from strings the model or user can shape, and check isolation on every read path, not just writes.