LangChain and Langflow security
Open-source frameworks and visual builders for LLM apps and agents.
The Injection has tracked 2 security stories affecting LangChain and Langflow since September 30, 2026 (vulnerability 1, research 1). The most recent, disclosed October 5, 2026, is "LangChain MongoDB chat history: query injection crosses sessions".
2
Stories
0
High or critical
1
With a CVE
2026-10-05
Latest disclosure
CVEs
| CVE | CVSS | Severity | Story |
|---|---|---|---|
| CVE-2026-106119 | 6 | Medium | LangChain MongoDB chat history: query injection crosses sessions |
Every LangChain and Langflow story
MED
Vulnerability · LangChain · CVE-2026-106119 · CVSS 6
LangChain MongoDB chat history: query injection crosses sessionsCVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.
INFO
Research · Google Threat Intelligence Group
Google GTIG: half of 2026 AI flaws hit agent orchestrationGoogle Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.
Questions people ask
- Does LangChain and Langflow have known security vulnerabilities?
- Yes. The Injection has tracked 1 story about LangChain and Langflow with a published CVE: CVE-2026-106119 (CVSS 6), query injection crosses sessions. Check each story for fixed versions.
- What is the latest LangChain and Langflow security issue?
- The most recent story is "LangChain MongoDB chat history: query injection crosses sessions" (medium severity), disclosed October 5, 2026 by LangChain. CVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.
- Which attack techniques have been used against LangChain and Langflow?
- Stories about LangChain and Langflow on The Injection most often involve agent memory, ai threat intelligence, mcp (model context protocol). Each technique has a glossary entry with a definition and every related story.