CVE-2026-63489
Deferred Deferred - Pending Action

Yeti Forensics Platform AQL Injection Vulnerability

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63489
EUVD
EUVD-2026-116263

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeti-platform yeti <= 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63489 is an AQL (ArangoDB Query Language) injection vulnerability in the Yeti platform versions 2.5.0 and earlier. It allows low-privileged authenticated users to inject malicious AQL expressions through the sorting and filter_aliases parameters in search endpoints. The vulnerability exists because user-controlled strings are directly interpolated into AQL queries without proper validation, enabling attackers to manipulate query logic, access sensitive data, or cause denial of service.

Detection Guidance

To detect this vulnerability, monitor API endpoints like /api/v2/observables/search, /api/v2/entities/search, and similar routes for unusual sorting or filter_aliases parameters. Check for AQL syntax errors in logs or responses, as attackers may trigger errors to confirm injection points. Use network traffic analysis to identify malformed queries or excessive resource consumption from ArangoDB.

Impact Analysis

This vulnerability can allow attackers to access sensitive data like password hashes or admin flags from internal collections, alter search logic, enumerate database schema, or consume excessive database resources causing denial of service. Exploitation requires only low-privileged authentication and network access.

Mitigation Strategies

Immediately upgrade to the latest version of Yeti if available. If not, implement strict validation for sorting and filter_aliases parameters to allow only alphanumeric characters, underscores, and dots. Block or sanitize inputs containing special characters or AQL keywords. Restrict low-privileged users' access to sensitive endpoints and monitor for suspicious query patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...