CVE-2026-106119: LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a literal value when multiple users' histories are stored in a shared MongoDB collection. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation. Applications using authenticated, server-controlled string identifiers are not affected. This issue is fixed in version 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LangChainto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to cross-session access?
Deployments are exposed when multiple users' chat histories are stored in a shared MongoDB collection and an untrusted caller can supply a structured session identifier to chat-history operations. Applications that use authenticated, server-controlled string identifiers are not affected.
What level of access does an attacker need?
The attacker must be able to invoke chat-history operations and provide the session identifier. Under those conditions, they may read, modify, or delete another user's stored conversation.
How can this be remediated?
Upgrade langchain-mongodb to version 1.3.1. The fix enforces the documented string type for session identifiers at runtime.
What can be done if an immediate upgrade is not possible?
Ensure session identifiers are authenticated, server-controlled string values rather than values supplied by untrusted users. This prevents a structured identifier from being interpreted as a MongoDB query condition.