LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

影響: pip:langgraph-checkpoint-postgres < 3.1.3 → 3.1.3, pip:langgraph-checkpoint-sqlite < 3.1.2 → 3.1.2

The Postgres and SQLite stores save a namespace as its labels joined with ., so ("tenant", "bob") and ("tenant.bob",) map to the same stored namespace. put rejected labels containing ., but get, search, delete, list_namespaces, their async versions, and ops passed directly to batch/abatch did not. A caller that could pass such a label could read, overwrite or delete items in another namespace. Details BaseStore checked namespace labels only in put/aput. The other methods passed the namespace on…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 07:06, GitHub Advisory Database에서 "LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python, PostgreSQL, SQLite. CVE: CVE-2026-115883.