The vulnerability permits a proxy server in Graph Explorer versions prior to 3.0.1 to automatically downgrade secure HTTP requests to insecure HTTP when required certificate files are missing. As a result, traffic that should have been encrypted can be captured by an attacker, leading to exposure of sensitive data such as authentication tokens, query parameters, or user credentials. The weakness is classified as CWE-319: Clearance of Sensitive Information Through the Use of an Insecure or Weak Cryptographic Protocol.

Affected systems include AWS Graph Explorer for all deployments using versions before 3.0.1. The vulnerability is tied to the product’s handling of TLS certificates and has no scope beyond the proxy service itself, as it does not allow arbitrary code execution or privilege escalation.

The CVSS score of 8.2 marks this as high severity. Because the EPSS score is not provided, the current estimate of exploitation probability is unknown; however, the vulnerability is publicly documented and lacks a mitigated reference, suggesting that exploitation is plausible with proper network visibility. The issue is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker who can intercept or observe traffic to the proxy can capture the downgraded HTTP stream, provided that a traffic monitoring solution is in place. The exploitation requires no user interaction, and no special application privileges are needed beyond ability to observe network traffic.