Threat · curated 8 Aug 2026
From SQLi to RCE - Exploiting LangGraph’s Checkpointer - Check Point Research
First reported · updated · 2 reports checkpoint.com
Coverage timeline
Why it matters
The Check Point findings show that agent-framework runtimes re-import classic vulnerability classes into the agentic stack, so an attacker exploiting prompt injection can escalate to remote code execution and credential theft against widely deployed frameworks like LangGraph (50M+ monthly downloads).
Check Point Research (Yarden Porat and Shahar Tal) disclosed 11 vulnerabilities across six major AI agent frameworks — LangChain, LangGraph, CrewAI, AutoGen, the Microsoft Agent Framework, and Google ADK — including insecure deserialization, SSRF, path traversal, SQL injection, and use-after-free flaws. The most severe were RCE chains: a checkpoint deserialization flaw in the Microsoft Agent Framework triggerable via prompt injection, unauthenticated code execution in Google ADK, and three LangGraph checkpointer bugs (CVE-2025-67644, CVE-2026-28277, CVE-2026-27022). All disclosed issues were patched.