LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

• use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
• rely on the namespace to separate data between users or tenants, and
• have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

• Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
• Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
• Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

• Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.