Description
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key.

Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
Published: 2026-09-25
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: Data Exposure Within Account
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from an unvalidated export_id parameter in the export-status component of Rapid7 Bulk Export MCP. The parameter is directly interpolated into a GraphQL query string, allowing an attacker to inject arbitrary root-level selections, including schema introspection or other queries that the operator already has permission to execute. The injection does not grant the attacker extra privileges beyond those of the authenticated operator; it simply enables them to run queries they could already run via the API.

Affected Systems

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are affected. The product belongs to Rapid7’s Platform suite. Affected installations can be identified by tracking the installed MCP version; the vulnerability is resolved in version 0.6.2 where the export_id is passed as a parameterized GraphQL variable.

Risk and Exploitability

The CVSS score is 2.7, indicating low severity, and there is no EPSS data recorded. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a compromised or intentionally malicious MCP client that can supply a crafted export_id argument; the attack can trigger arbitrary queries but is limited to the operator’s authenticated scope. Mitigation is straightforward by applying the vendor’s patch.

Generated by OpenCVE AI on September 25, 2026 at 12:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Rapid7 Bulk Export MCP to version 0.6.2 or later to apply the parameterized query fix.
  • Validate all user-supplied export_id values on the client side and reject strings containing quotes or braces before sending them to the API.
  • Monitor server logs for unusual GraphQL queries or injection patterns to detect potential misuse of the export_status endpoint.

Generated by OpenCVE AI on September 25, 2026 at 12:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key. Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
Title Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup
Weaknesses CWE-943
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published:

Updated: 2026-09-25T11:21:15.908Z

Reserved: 2026-09-24T10:00:04.695Z

Link: CVE-2026-97228

cve-icon Vulnrichment

Updated: 2026-09-25T11:21:12.877Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T11:17:02.163

Modified: 2026-09-25T13:26:09.190

Link: CVE-2026-97228

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T12:45:17Z

Weaknesses
  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic