AI Risk Wire

Cases › security breach › LR-2026-0440

LangChain and LangGraph flaws expose files, secrets and databases

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: fix reported

Severity major
Reported 27 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Unbounded scope stated: the three flaws offer paths to drain sensitive data from any enterprise LangChain deployment. The source states no realised harm, so the test is met by scope, not by losses.

Researchers disclosed three security vulnerabilities in LangChain and LangGraph, open-source frameworks used to build applications powered by large language models. The flaws include a path traversal in LangChain's prompt-loading API, a deserialization bug in LangChain that leaks API keys and environment secrets, and an SQL injection in LangGraph's SQLite checkpoint implementation. If exploited, they could expose filesystem files, environment secrets and conversation history. Cyera security researcher Vladimir Tokarev reported the findings in a report published Thursday. The source states that the vulnerabilities have been patched in listed versions. It does not state any exploitation in the wild for these flaws, nor any count of affected parties.

What happened

1 · What it was doingLangChain and LangGraph are open-source frameworks for building applications powered by large language models.
2 · What went wrongA LangChain deserialization flaw can leak API keys and environment secrets.

What was done

Fix reported

“The vulnerabilities have been patched in the following versions -”

Known flaws patched

Risks

Data leaked or sent out
Primary32 incidents
AI system attacked or breached
Also23 incidents
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Evidence

No source states: what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

  1. 2025-12 Details of CVE-2025-68664 were shared by Cyata.
Show every field, with its source and grade

The AI system

What it was for
building applications powered by Large Language Models (LLMs)
C one secondary source states it

What happened

Earliest source we hold
2026-03-27
D inferred by us from the described behaviour, reason shown
What went wrong
security breach
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown
secondary risks
RK08, RK03
D inferred by us from the described behaviour, reason shown
remediations
kind: fix; controls added: J1; quote: The vulnerabilities have been patched in the following versions -; source index: 0
C one secondary source states it

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
no harm happened
C one secondary source states it
Who was affected
any enterprise LangChain deployment
C one secondary source states it
Why this severity
Unbounded scope stated: the three flaws offer paths to drain sensitive data from any enterprise LangChain deployment. The source states no realised harm, so the test is met by scope, not by losses.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The source describes three disclosed vulnerabilities, not an incident with a stated occurrence. No autonomous agent is described, so no agent or failure fields are given. The disclosure date uses the article's publication date from the source header (2026-03-27), and the Thursday report is taken as that date. The patch remediation is attributed to J1 because the source says the vulnerabilities were patched, without naming the party that patched them. The Langflow flaw mentioned in the source is a separate incident and is excluded.

LR-2026-0440 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON