CVE-2026-97228: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in Rapid7 Platform
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key. Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
AI Analysis
Technical Summary
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection vulnerability in the export-status component (get_export_status in src/export_manager.py). The export_id parameter, which is an unvalidated input, is directly interpolated into the GraphQL query string, allowing crafted export_id values containing special characters to prematurely terminate the intended query and append attacker-controlled selections. This results in execution of attacker-controlled GraphQL queries under the operator's authenticated API key. However, the vulnerability does not grant access beyond the operator's existing privileges and cannot cross tenant boundaries. The issue is fixed in version 0.6.2 by passing export_id as a parameterized GraphQL variable.
Potential Impact
The impact is limited to the operator's own API scope since the injected queries execute with the operator's valid API key and privileges. There is no privilege escalation or cross-tenant data access. The vulnerability could be exploited if an upstream MCP client is compromised or careless, or if unvalidated input is forwarded indirectly. The CVSS score is 2.7 (low severity), reflecting limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
A fix is available in Rapid7 Bulk Export MCP version 0.6.2, which addresses the issue by using parameterized GraphQL variables for the export_id parameter. Users should upgrade to version 0.6.2 or later to remediate this vulnerability. No additional mitigation actions are required as the vulnerability does not elevate privileges or cross tenant boundaries.
CVE-2026-97228: CWE-943: Improper Neutralization of Special Elements in Data Query Logic in Rapid7 Platform
Description
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key. Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
CVSS v3.1
Score 2.7low
Affected software
Rapid7
Platform
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection vulnerability in the export-status component (get_export_status in src/export_manager.py). The export_id parameter, which is an unvalidated input, is directly interpolated into the GraphQL query string, allowing crafted export_id values containing special characters to prematurely terminate the intended query and append attacker-controlled selections. This results in execution of attacker-controlled GraphQL queries under the operator's authenticated API key. However, the vulnerability does not grant access beyond the operator's existing privileges and cannot cross tenant boundaries. The issue is fixed in version 0.6.2 by passing export_id as a parameterized GraphQL variable.
Potential Impact
The impact is limited to the operator's own API scope since the injected queries execute with the operator's valid API key and privileges. There is no privilege escalation or cross-tenant data access. The vulnerability could be exploited if an upstream MCP client is compromised or careless, or if unvalidated input is forwarded indirectly. The CVSS score is 2.7 (low severity), reflecting limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
A fix is available in Rapid7 Bulk Export MCP version 0.6.2, which addresses the issue by using parameterized GraphQL variables for the export_id parameter. Users should upgrade to version 0.6.2 or later to remediate this vulnerability. No additional mitigation actions are required as the vulnerability does not elevate privileges or cross tenant boundaries.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- rapid7
- Date Reserved
- 2026-09-24T10:00:04.695Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab64e07f7a7c54106a84bbd
Added to database: 09/25/2026, 10:33:43 UTC
Last enriched: 09/25/2026, 10:47:41 UTC
Last updated: 09/26/2026, 02:49:14 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.