---
title: Agent memory isolation: a dot in a LangGraph store namespace let one tenant read, overwrite or delete another tenant's long-term memory (CVE-2026-115883) | ctxsec
url: https://ctxsec.com/items/langgraph-store-namespace-dot-cross-tenant-cve-2026-115883
description: ""
status: "confirmed (LangGraph advisory, GitHub Advisory Database Oct 23; rated medium); no exploitation reported"
published: 2026-10-24
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/langgraph-store-namespace-dot-cross-tenant-cve-2026-115883.md)

confirmed (LangGraph advisory, GitHub Advisory Database Oct 23; rated medium); no exploitation reported

2026-10-24

### Agent memory isolation: a dot in a LangGraph store namespace let one tenant read, overwrite or delete another tenant's long-term memory (CVE-2026-115883)

LangGraph's Postgres and SQLite stores, often used for agents' long-term memory, saved a namespace as its labels joined with `.`. So `("tenant", "bob")` and `("tenant.bob",)` pointed to the same data. Only `put` rejected dots. `get`, `search`, `delete`, `list_namespaces` and `batch` calls did not.

- **Impact:** if untrusted input (a user ID, or a value an agent picks) chooses a namespace label, a caller could read, overwrite or delete another user's or tenant's stored memories.
- **Fixed:** `langgraph-checkpoint-postgres` 3.1.3 and `langgraph-checkpoint-sqlite` 3.1.2 (both need `langgraph-checkpoint` 4.3.0). The Agent Server rejects such labels from 0.15.5 / 0.16.2. LangSmith Cloud deployments get the fix on their next revision; self-hosted deployments need to upgrade. `InMemoryStore` is not affected.

Lesson for any agent memory layer: build tenant keys from server-side identity, never from strings the model or user can shape, and check isolation on every read path, not just writes.

Sources: [LangGraph advisory GHSA-6hmw-9432-67qq / CVE-2026-115883](https://github.com/langchain-ai/langgraph/security/advisories/GHSA-6hmw-9432-67qq)