Check Point disclosed 11 vulnerabilities across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, and the bug classes are SQL injection, unsafe deserialization, SSRF and path traversal. Ordinary application security, one layer above the model.
The one under active attack is CVE-2026-9198 in Langflow, CVSS 9.8, an unauthenticated endpoint that hands out superuser tokens chained to an endpoint that runs attacker-supplied Python through exec(). CISA added it to the Known Exploited Vulnerabilities catalog on 4 August.
Prompt injection is the delivery mechanism here, not the vulnerability. If your threat model stops at the model boundary, it stops one layer above the code that is actually getting popped.
The chain that made LangGraph interesting
Check Point's LangGraph writeup covers three CVEs, and the interesting part is that none of them is impressive on its own.
CVE-2025-67644 is SQL injection in the SQLite checkpointer's metadata filtering. CVE-2026-27022 is the same bug in the Redis checkpointer. CVE-2026-28277 is unsafe msgpack deserialization in the checkpoint library. Any one of those would be a routine ticket in a normal web application.
Wired together they are a remote shell. The attacker crafts a msgpack payload that carries a shell command. The SQL injection lets them write a fake checkpoint row into the state store with that payload sitting in it. LangGraph then does what it is designed to do, which is load a checkpoint and deserialize it. The deserializer reaches os.system() and the command runs.
The precondition is specific enough to check in about five minutes. Your application has to expose get_state_history() with a filter parameter that a user can influence, and you have to be on the SQLite or Redis checkpointer. The Postgres checkpointer is not affected, and neither is LangSmith Deployment, which runs on Postgres.
The patches shipped a while ago. langgraph-checkpoint-sqlite 3.0.1 in December, langgraph-checkpoint-redis 1.0.2 in February, langgraph-checkpoint 4.0.1 in March, with LangGraph itself covered from 1.0.10. Check Point reported all three to LangChain on 19 November 2025 and LangChain fixed the SQL injection quickly, which breaks the chain even if you are behind on the other two.
So the news is not an open hole in LangGraph. The news is what the shape of the hole tells you, on a package pulling over 50 million downloads a month from PyPI.
The one that is actually being exploited
Langflow is a visual builder for LLM workflows, now maintained by IBM. CVE-2026-9198 is the reason it matters this week.
Two endpoints. /api/v1/auto_login does not enforce authentication and is not restricted to loopback, so it will return a superuser bearer token to anyone who can reach the port. /api/v1/validate/code takes that token and executes whatever Python you hand it via exec(). Chain them and you have full remote code execution with no login, no user interaction and no prior access.
Versions 1.0.0 through 1.10.0 are affected. IBM disclosed and patched on 17 July, same day, in 1.10.1. Current stable is 1.11.2. Public proof-of-concept exploits followed within days, and telemetry from the weeks after showed hundreds of exploitation attempts from 244 unique IP addresses across 41 countries. CISA put it in the KEV catalog on 4 August with a federal remediation deadline days later.
Read the mechanism again, because there is no model in it. No prompt, no context window, no jailbreak, no tool call. An auth endpoint that forgot to check auth, and a code endpoint that runs code. This is the kind of bug that would have been embarrassing in a PHP app in 2009.
It is in the KEV catalog because people are using it right now.
Where the boundary actually sits
The industry has spent two years building defenses at the model boundary. Injection classifiers, guardrail models, output filters, refusal tuning, red team suites that measure how often you can talk a model into something. All useful. All aimed at a layer above the one that is failing.
Check Point's framing across the eleven bugs is a boundary failure: attacker-controlled content crosses out of the data plane and into trusted logic, memory, routing and state handling. Prompt injection is how the content gets in. The vulnerability is what the middleware does with it once it is inside.
Look at how the individual findings land. A Microsoft Agent Framework issue that gets you RCE through loading an untrusted checkpoint. A Google ADK file-writing assistant reachable over HTTP by default. Deserialization, SSRF, path traversal, use-after-free. Every one of these is a bug class with thirty years of literature, a linter, and a chapter in every appsec course ever written.
They keep showing up here because agent frameworks do three things that make old bugs expensive again. They persist state and load it back, which means serialization on a path an attacker can touch. They hold the credentials for everything the agent reaches, so one shell gets you LLM API keys, customer data, CRM tokens, conversation history and internal network position. And they ship dev-mode defaults into production, because the thing started as a notebook and became infrastructure without anyone re-reading the config.
Microsoft's own security team published a piece on RCE in agent frameworks back in May. This is not a one-off week. It is a bug class settling in.
What to actually do about it
Treat the framework as an internet-facing application with a database, a deserializer and a credential store, because that is what it is. That framing does more work than any agent-specific guidance.
Concretely, four things worth an afternoon.
Go find every agent framework in your dependency tree and check the version, including the transitive ones. langgraph-checkpoint-sqlite is not something most teams put in a requirements file on purpose.
Check whether any framework UI or API is reachable from outside your network. Langflow, Flowise, and most of the visual builders assume a trusted local network and then get deployed with a public load balancer in front. If it is exposed, put real authentication in front of it at the proxy, and do not rely on the framework's own auth.
Look at what your state backend is. If you are on SQLite or Redis checkpointers with user-influenced filters, that is a specific thing to fix, not a general worry. Postgres avoids this particular chain.
And scope the agent's credentials to what it actually needs. The reason a checkpoint deserialization bug turns into a bad week is that the process holding it has keys to the CRM. Treat the agent as a privileged identity with a short-lived credential, not as a service account someone provisioned once in a hurry.
None of this is novel security advice. That is the point. The agent stack got new capabilities and inherited an old attack surface, and the part of the stack getting exploited this month is the part that looks least like AI.