CVE-2026-27794 is a deserialization of untrusted data vulnerability (CWE-502) affecting langchain-ai's langgraph-checkpoint library versions before 4.0.0. LangGraph Checkpoint provides an interface for checkpointing in LangGraph, and its caching layer uses a BaseCache class that defaults to JsonPlusSerializer with a fallback to Python's pickle deserialization when msgpack serialization fails. Because pickle can execute arbitrary code during deserialization, this fallback creates a remote code execution (RCE) risk if an attacker can inject malicious serialized data into the cache. The vulnerability manifests only when caching is explicitly enabled by the application, and nodes opt into caching via CachePolicy. Exploitation requires the attacker to write attacker-controlled bytes into the cache backend, which could be a networked cache like Redis with weak or no authentication, shared cache infrastructure accessible by multiple tenants, or a writable SQLite cache file with permissive permissions. Since the attacker must already have write access to the cache storage, this vulnerability is primarily a post-compromise escalation vector rather than an initial attack vector. The vulnerability was patched in langgraph-checkpoint version 4.0.0 by removing the unsafe pickle fallback. The CVSS v3.1 score is 6.6, indicating medium severity, with attack vector network, high attack complexity, requiring privileges, no user interaction, and impacting confidentiality, integrity, and availability. No known exploits are reported in the wild as of now.

The primary impact of this vulnerability is remote code execution on systems running vulnerable versions of langgraph-checkpoint with caching enabled and writable cache backends exposed to attackers. Successful exploitation could allow attackers to execute arbitrary code with the privileges of the LangGraph process, potentially leading to full system compromise, data theft, or disruption of services. Because exploitation requires write access to the cache backend, this vulnerability is most dangerous in environments where cache storage is shared, network-accessible without strong authentication, or improperly secured. Organizations using LangGraph in multi-tenant or cloud environments with shared caching infrastructure are at higher risk. The vulnerability can be leveraged as a post-compromise escalation vector to deepen attacker footholds or pivot within networks. Although the CVSS score is medium, the impact on confidentiality, integrity, and availability is high if exploited. The lack of default caching reduces the attack surface, but explicit enabling of caching with vulnerable versions increases risk significantly.

1. Upgrade langgraph-checkpoint to version 4.0.0 or later, where the unsafe pickle fallback has been removed. 2. Disable caching if it is not strictly required by the application to reduce attack surface. 3. Secure cache backends by enforcing strong authentication and network access controls, especially for Redis or other networked caches. 4. Avoid sharing cache infrastructure across tenants or services without strict isolation. 5. Restrict file system permissions on local cache files to prevent unauthorized write access. 6. Monitor cache backend access logs for unauthorized writes or suspicious activity. 7. Implement application-level input validation and integrity checks on cached data if possible. 8. Conduct regular security audits of caching configurations and infrastructure. 9. Consider container or process isolation to limit the impact of potential code execution. 10. Educate developers and DevOps teams about the risks of deserialization vulnerabilities and secure coding practices related to caching.