GraphQL Query Injection in Rapid7 Bulk Export MCP
CVE-2026-97228

2.7LOW

Key Information:

Vendor

Rapid7

Status
Platform
Vendor
CVE Published:
25 September 2026

What is CVE-2026-97228?

The Rapid7 Bulk Export MCP is vulnerable to a GraphQL query injection flaw present in the export-status component, affecting versions 0.2.5 through 0.6.1. An unvalidated export_id argument is directly inserted into a GraphQL query. This can allow an attacker to manipulate the query structure, leading to potential exposure of internal data. While this vulnerability does not allow unauthorized access beyond the operator's currently authenticated scope, careful handling of API keys is required to prevent exploitation. The issue is addressed in version 0.6.2, which implements parameterized GraphQL variables for enhanced security.

Affected Version(s)

Platform 0 < 0.6.2

References

https://github.com/rapid7/rapid7-bulk-export-mcp/releases...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Syed Anas Mohiuddin, Independent Researcher
.