6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27794

CVE-2026-27794: LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution

LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in LangGraph's caching layer when applications enable cache backends that inherit from BaseCache and opt nodes into caching via CachePolicy. Prior to langgraph-checkpoint 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle_fallback=True). When msgpack serialization fails, cached values can be deserialized via pickle.loads(...). Caching is not enabled by default. Applications are affected only when the application explicitly enables a cache backend (for example by passing cache=... to StateGraph.compile(...) or otherwise configuring a BaseCache implementation), one or more nodes opt into caching via CachePolicy, and the attacker can write to the cache backend (for example a network-accessible Redis instance with weak/no auth, shared cache infrastructure reachable by other tenants/services, or a writable SQLite cache file). An attacker must be able to write attacker-controlled bytes into the cache backend such that the LangGraph process later reads and deserializes them. This typically requires write access to a networked cache (for example a network-accessible Redis instance with weak/no auth or shared cache infrastructure reachable by other tenants/services) or write access to local cache storage (for example a writable SQLite cache file via permissive file permissions or a shared writable volume). Because exploitation requires write access to the cache storage layer, this is a post-compromise / post-access escalation vector. LangGraph Checkpoint 4.0.0 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27794

CVE-2026-27794:

6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langgraph-checkpoint	pip	< 4.0.0	4.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is the deserialization of untrusted data using pickle, which can lead to remote code execution. The langgraph-checkpoint library's BaseCache class used JsonPlusSerializer with pickle_fallback=True as its default serializer. When an application enables a cache backend that inherits from BaseCache (e.g., InMemoryCache, RedisCache), this insecure default is active.

An attacker with write access to the cache backend could store a malicious pickle payload. When the LangGraph application attempts to retrieve this data from the cache, the JsonPlusSerializer.loads_typed method would be invoked. This method would identify the payload as a pickle object and use pickle.loads to deserialize it, resulting in arbitrary code execution in the context of the LangGraph process.

The vulnerability is fixed in langgraph-checkpoint>=4.0.0 by changing the default setting in BaseCache to JsonPlusSerializer(pickle_fallback=False), thus disabling the dangerous fallback to pickle.

Vulnerable functions

JsonPlusSerializer.loads_typed

libs/checkpoint/langgraph/checkpoint/serde/jsonplus.py

This function is the deserialization sink. It deserializes data from the cache. If the data is in pickle format and pickle fallback is enabled, it uses the insecure `pickle.loads` function, leading to potential remote code execution if an attacker can control the content of the cache.

BaseCache.__init__

libs/checkpoint/langgraph/cache/base/__init__.py

The `BaseCache` class, initialized via this constructor, used a default serializer (`JsonPlusSerializer`) that had `pickle_fallback=True`. This created the precondition for the deserialization vulnerability, as it allowed for the use of `pickle.loads`. Any cache backend inheriting from `BaseCache` without explicitly providing a secure serializer was vulnerable. The patch changes this default to be secure (`pickle_fallback=False`).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.