PT-2026-21967 · Redis+3 · Redis+3
Zdi-Disclosures
·
Publicado
2026-02-25
·
Atualizado
2026-03-03
·
CVE-2026-27794
CVSS v3.1
6.6
Média
| Vetor | AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LangGraph versions prior to 4.0.0
Description
A Remote Code Execution issue exists in LangGraph's caching layer when applications enable cache backends inheriting from
BaseCache and opt nodes into caching via CachePolicy. Prior to version 4.0.0, BaseCache defaults to JsonPlusSerializer(pickle fallback=True). When msgpack serialization fails, cached values can be deserialized using pickle.loads(...). Exploitation requires write access to the cache backend, such as a network-accessible Redis instance with weak or no authentication, shared cache infrastructure, or a writable SQLite cache file. An attacker must be able to write attacker-controlled bytes into the cache backend, which the LangGraph process later reads and deserializes. This is considered a post-compromise/post-access escalation vector. The issue is resolved in langgraph-checkpoint version 4.0.0 by disabling pickle fallback by default (pickle fallback=False).Recommendations
Upgrade to
langgraph-checkpoint version 4.0.0 or later.Exploit
Correção
RCE
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Jsonplusserializer
Langgraph
Redis
Sqlite