CVE-2026-32247

{"id": "CVE-2026-32247", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2026-03-12T19:16:19.733", "references": [{"url": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getzep/graphiti/pull/1312", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getzep/graphiti/releases/tag/v0.28.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2."}, {"lang": "es", "value": "Graphiti es un framework para construir y consultar grafos de contexto temporal para agentes de IA. Las versiones de Graphiti anteriores a la 0.28.2 conten\u00edan una vulnerabilidad de inyecci\u00f3n Cypher en la construcci\u00f3n compartida de filtros de b\u00fasqueda para backends que no eran Kuzu. Los valores de etiquetas controlados por el atacante, suministrados a trav\u00e9s de SearchFilters.node_labels, se concatenaban directamente en expresiones de etiquetas Cypher sin validaci\u00f3n. En las implementaciones de MCP, esto era explotable no solo a trav\u00e9s del acceso directo no confiable al servidor MCP de Graphiti, sino tambi\u00e9n a trav\u00e9s de la inyecci\u00f3n de prompts contra un cliente LLM que pod\u00eda ser inducido a llamar a search_nodes con valores de entity_types controlados por el atacante. El servidor MCP mapeaba los entity_types a SearchFilters.node_labels, que luego alcanzaban la ruta de construcci\u00f3n Cypher vulnerable. Los backends afectados inclu\u00edan Neo4j, FalkorDB y Neptune. Kuzu no se vio afectado por el problema de inyecci\u00f3n de etiquetas porque utilizaba un manejo de etiquetas parametrizado en lugar de etiquetas Cypher interpoladas por cadena. Este problema se mitig\u00f3 en la 0.28.2."}], "lastModified": "2026-03-18T14:38:09.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getzep:graphiti:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F936A08-BA4E-46CE-B94A-5819ACC1C584", "versionEndExcluding": "0.28.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}