CVE-2026-10584 - HTTPS Fallback to HTTP in Graph Explorer
Bulletin ID: 2026-038-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/02/2026 12:15 PM PDT Description: Graph Explorer is an open source application that provides visualization and exploration of data in graph databases such as Amazon Neptune. We identified CVE-2026-10584 where, under certain circumstances, the server silently falls back to HTTP when HTTPS is enabled but certificates are unavailable, resulting in cleartext transmission of sensitive information. Impacted versions: >= 1.1.0 AND < 3.0.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
Graph Explorer versions >=1.1.0 and <3.0.1 suffer from a vulnerability where, if HTTPS is enabled but the server cannot obtain valid certificates, it silently downgrades connections to HTTP. This fallback results in sensitive information being transmitted in cleartext, undermining the confidentiality guarantees of HTTPS. The issue is resolved in version 3.0.1. AWS recommends upgrading to this version or applying specific configuration workarounds to ensure HTTPS is properly enforced and certificates are correctly generated.
Potential Impact
Sensitive information intended to be protected by HTTPS may be transmitted in cleartext due to fallback to HTTP, increasing the risk of interception by network attackers. The impact is limited to confidentiality exposure and does not include remote code execution or other elevated impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in Graph Explorer version 3.0.1; upgrading to this version fully resolves the issue. If immediate upgrade is not possible, verify that deployments serve content over HTTPS by checking the protocol in browsers or via command-line tools like curl. Ensure the HOST environment variable is set during docker runs to enable proper certificate generation. Avoid using non-default configuration directory paths when relying on automatic self-signed certificate generation. These steps help prevent fallback to HTTP and maintain encrypted communication.
CVE-2026-10584 - HTTPS Fallback to HTTP in Graph Explorer
Description
Bulletin ID: 2026-038-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/02/2026 12:15 PM PDT Description: Graph Explorer is an open source application that provides visualization and exploration of data in graph databases such as Amazon Neptune. We identified CVE-2026-10584 where, under certain circumstances, the server silently falls back to HTTP when HTTPS is enabled but certificates are unavailable, resulting in cleartext transmission of sensitive information. Impacted versions: >= 1.1.0 AND < 3.0.1 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Graph Explorer versions >=1.1.0 and <3.0.1 suffer from a vulnerability where, if HTTPS is enabled but the server cannot obtain valid certificates, it silently downgrades connections to HTTP. This fallback results in sensitive information being transmitted in cleartext, undermining the confidentiality guarantees of HTTPS. The issue is resolved in version 3.0.1. AWS recommends upgrading to this version or applying specific configuration workarounds to ensure HTTPS is properly enforced and certificates are correctly generated.
Potential Impact
Sensitive information intended to be protected by HTTPS may be transmitted in cleartext due to fallback to HTTP, increasing the risk of interception by network attackers. The impact is limited to confidentiality exposure and does not include remote code execution or other elevated impacts. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in Graph Explorer version 3.0.1; upgrading to this version fully resolves the issue. If immediate upgrade is not possible, verify that deployments serve content over HTTPS by checking the protocol in browsers or via command-line tools like curl. Ensure the HOST environment variable is set during docker runs to enable proper certificate generation. Avoid using non-default configuration directory paths when relying on automatic self-signed certificate generation. These steps help prevent fallback to HTTP and maintain encrypted communication.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-038-aws/","fetched":true,"fetchedAt":"2026-06-02T19:30:41.992Z","wordCount":206}
Threat ID: 6a1f2f61e29bf47b50f7464d
Added to database: 06/02/2026, 19:30:41 UTC
Last enriched: 06/10/2026, 08:55:51 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 238
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.