{"schema_version":"0.10.0","id":"LR-2026-0440","record_version":1,"title":"LangChain and LangGraph flaws expose files, secrets and databases","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"7885d7ddc153adc964ccc6571f0bbb525667422ef0c0354cfac9c827d9eedcf7"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"building applications powered by Large Language Models (LLMs)","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-27","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Researchers disclosed three security vulnerabilities in LangChain and LangGraph, open-source frameworks used to build applications powered by large language models. The flaws include a path traversal in LangChain's prompt-loading API, a deserialization bug in LangChain that leaks API keys and environment secrets, and an SQL injection in LangGraph's SQLite checkpoint implementation. If exploited, they could expose filesystem files, environment secrets and conversation history. Cyera security researcher Vladimir Tokarev reported the findings in a report published Thursday. The source states that the vulnerabilities have been patched in listed versions. It does not state any exploitation in the wild for these flaws, nor any count of affected parties.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK08","RK03"],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["J1"],"quote":"The vulnerabilities have been patched in the following versions -","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Unbounded scope stated: the three flaws offer paths to drain sensitive data from any enterprise LangChain deployment. The source states no realised harm, so the test is met by scope, not by losses.","harm_class":["none_materialised"],"affected_description":"any enterprise LangChain deployment","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.html","publisher":"The Hacker News","date":"2026-03-27","type":"press","title":"LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.intended_use":"C","event.incident_class":"C","impact.affected_description":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"Both LangChain and LangGraph are open-source frameworks that are used to build applications powered by Large Language Models (LLMs)."}],"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have disclosed three security vulnerabilities impacting LangChain and LangGraph that, if successfully exploited, could expose filesystem data, environment secrets, and conversation history."}],"impact.affected_description":[{"source_index":0,"quote":"The issues, in a nutshell, offer three independent paths that an attacker can leverage to drain sensitive data from any enterprise LangChain deployment."}],"impact.harm_class":[{"source_index":0,"quote":"Cybersecurity researchers have disclosed three security vulnerabilities impacting LangChain and LangGraph that, if successfully exploited, could expose filesystem data, environment secrets, and conversation history."}],"impact.severity":[{"source_index":0,"quote":"The issues, in a nutshell, offer three independent paths that an attacker can leverage to drain sensitive data from any enterprise LangChain deployment."}],"impact.severity_because":[{"source_index":0,"quote":"The issues, in a nutshell, offer three independent paths that an attacker can leverage to drain sensitive data from any enterprise LangChain deployment."}],"event.remediations":[{"source_index":0,"quote":"The vulnerabilities have been patched in the following versions -"}],"event.summary":[{"source_index":0,"quote":"Both LangChain and LangGraph are open-source frameworks that are used to build applications powered by Large Language Models (LLMs)."},{"source_index":0,"quote":"Successful exploitation of the aforementioned flaws could allow an attacker to read sensitive files like Docker configurations, siphon sensitive secrets via prompt injection, and access conversation histories associated with sensitive workflows."},{"source_index":0,"quote":"Cyera security researcher Vladimir Tokarev said in a report published Thursday."},{"source_index":0,"quote":"The vulnerabilities have been patched in the following versions -"}]},"notes_on_gaps":"The source describes three disclosed vulnerabilities, not an incident with a stated occurrence. No autonomous agent is described, so no agent or failure fields are given. The source does not state the date of occurrence, any realised exploitation, any affected party count, records, losses, a developer, model, country, or root-cause category. The disclosure date uses the article's publication date from the source header (2026-03-27), and the Thursday report is taken as that date. Severity is judged as major on the unbounded-scope test ('any enterprise LangChain deployment'), though no harm is stated as realised. No controls are stated as held, failed or missing for this incident, so links is empty. The patch remediation is attributed to J1 because the source says the vulnerabilities were patched, without naming the party that patched them. The Langflow flaw mentioned in the source is a separate incident and is excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"LangChain and LangGraph are open-source frameworks for building applications powered by large language models.","quote":"Both LangChain and LangGraph are open-source frameworks that are used to build applications powered by Large Language Models (LLMs).","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A LangChain deserialization flaw can leak API keys and environment secrets.","quote":"A deserialization of untrusted data vulnerability in LangChain that leaks API keys and environment secrets by passing as input a data structure that tricks the application into interpreting it as an already serialized LangChain object rather than regular user data.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.html"]},"analysis":{"sections":{"timeline":[{"text":"Details of CVE-2025-68664 were shared by Cyata.","quote":"It's worth noting that details of CVE-2025-68664 were also shared by Cyata in December 2025, giving it the cryptonym LangGrinch.","source_index":0,"when":"2025-12"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/03/langchain-langgraph-flaws-expose-files.html"]}}