---
id: CVE-2026-27794
title: >-
  langgraph-checkpoint: LangGraph Checkpoint: Remote Code Execution via insecure
  deserialization in caching layer (CVE-2026-27794)
summary: >-
  A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote
  attacker with write access to the cache backend to achieve remote code
  execution. This occurs when applications enable cache backends that inherit
  from `BaseCache…
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-502
vendor: Red Hat
product: OpenShift Lightspeed
affected:
  - openshift_lightspeed
  - openshift_ai_rhoai
patched:
  - langgraph-checkpoint 4.0.0
published: '2026-02-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:34:26+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27794.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27794.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27794'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2442692'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27794'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27794'
  - url: >-
      https://github.com/langchain-ai/langgraph/commit/f91d79d0c86932ded6e3b9f195d5a0bbd5aef99c
  - url: 'https://github.com/langchain-ai/langgraph/pull/6677'
  - url: >-
      https://github.com/langchain-ai/langgraph/releases/tag/checkpoint%3D%3D4.0.0
  - url: >-
      https://github.com/langchain-ai/langgraph/security/advisories/GHSA-mhr3-j7m5-c7c9
  - url: 'https://github.com/langchain-ai/langgraph'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00836
epssPercentile: 0.57536
aliases:
  - GHSA-mhr3-j7m5-c7c9
  - PYSEC-2026-2574
ecosystem: pip
ingestedAt: '2026-07-13T18:58:00.646Z'
---

## Overview

A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from `BaseCache` and opt nodes into caching via `CachePolicy`. If `msgpack` serialization fails, cached values can be deserialized using `pickle.loads(...)`, leading to the execution of arbitrary code. Exploitation requires prior write access to the cache storage layer, making it a post-compromise escalation vector.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI) · no fix planned: OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI) · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27794.json)

**langgraph-checkpoint: LangGraph Checkpoint: Remote Code Execution via insecure deserialization in caching layer** — rated Moderate by Red Hat. Released 2026-02-25, updated 2026-10-15.

Affected:

- OpenShift Lightspeed
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- OpenShift Lightspeed
- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

## Package advisory (CVE-2026-27794)

Affected packages:

- `langgraph-checkpoint < 4.0.0`

Patched in:

- `langgraph-checkpoint 4.0.0`

Source: https://osv.dev/vulnerability/GHSA-mhr3-j7m5-c7c9