Why it matters
LangGraph checkpoints hold full agent state — conversation history, intermediate reasoning, tool outputs. In a multi-tenant SaaS built on LangGraph+MongoDB, this lets one authenticated tenant read another tenant's agent session data, a direct cross-customer data leak in a widely-used agent orchestration stack.
Attack vector
MongoDBSaver.list()/alist() and MongoDBStore.search() incorporate filter dictionaries into MongoDB queries without recursively rejecting $-prefixed keys. An authenticated caller who controls a filter argument (via HTTP params, request body, or agent tool arguments) can inject operators like $regex/$where to bypass tenant-isolation equality filters and read other tenants' LangGraph checkpoint/store data.
Affected systems
langgraph-checkpoint-mongodb < 0.3.0; langgraph-store-mongodb < 0.4.0
Mitigation
Upgrade to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0.