CVE-2026-63421

Received Received - Intake

Keystone CMS GraphQL Query Take Bypass

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-63421

EUVD

EUVD-2026-64134

Affected Vendors & Products

Vendor	Product	Version / Range
keystonejs	keystone	6.5.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-480	The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Attack-Flow Graph

Executive Summary

This vulnerability in Keystone CMS allows a remote unauthenticated GraphQL client to bypass a limit on data retrieval by providing a negative take value. The system compares the take argument directly with a maximum value without proper validation, enabling attackers to request more records than intended. This can lead to resource exhaustion on the server.

Detection Guidance

To detect this vulnerability, check if your Keystone version is below 6.5.3. Run: npm list keystone or grep version in package.json. Monitor GraphQL queries for unusually large result sets or resource exhaustion.

Impact Analysis

An attacker could exploit this to retrieve excessive amounts of data, causing high server load, degraded performance, or even a denial of service. If sensitive data is exposed, it may also lead to unauthorized access or information leakage.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if sensitive data is leaked due to excessive data retrieval.

Mitigation Strategies

Upgrade Keystone to version 6.5.3 or later immediately. If upgrading is not possible, restrict access to GraphQL endpoints and implement rate limiting to prevent abuse.

Hi! I’m here to help you understand CVE-2026-63421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70