CVE-2026-1170
📋 TL;DR
This vulnerability in birkir prime's GraphQL API allows remote attackers to access sensitive information through manipulation of the /graphql endpoint. It affects all versions up to 0.4.0.beta.0, enabling unauthorized data disclosure without authentication.
💻 Affected Systems
- birkir prime
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of sensitive application data, user information, or system details leading to data breach and compliance violations.
Likely Case
Partial information disclosure revealing system configuration, API structure, or limited sensitive data that could aid further attacks.
If Mitigated
No data exposure if proper access controls, input validation, and GraphQL query restrictions are implemented.
🎯 Exploit Status
Exploit is publicly available and can be initiated remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub issue for updates: https://github.com/birkir/prime/issues/541
🔧 Temporary Workarounds
Restrict GraphQL API Access
allLimit access to the /graphql endpoint using network controls or authentication.
# Use firewall rules to restrict access
# Example for iptables: iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_IPS] -j ACCEPT
Implement GraphQL Query Depth Limiting
allAdd middleware to restrict query complexity and depth to prevent information disclosure.
# Implementation depends on GraphQL server library
# Example for graphql-ruby: max_depth: 10, max_complexity: 100
🧯 If You Can't Patch
- Isolate the birkir prime instance behind a reverse proxy with strict access controls
- Implement Web Application Firewall (WAF) rules to block suspicious GraphQL queries
🔍 How to Verify
Check if Vulnerable:
Test if unauthorized GraphQL queries to /graphql endpoint return sensitive information. Use tools like GraphQL introspection queries.Check Version:
Check birkir prime version in application configuration or package manager: dpkg -l | grep prime or rpm -qa | grep primeVerify Fix Applied:
Verify that GraphQL queries no longer disclose information without proper authentication and that access controls are enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL query patterns
- Multiple failed authentication attempts to /graphql
- Large data transfers from GraphQL endpoint
Network Indicators:
- Unusual traffic to /graphql endpoint from untrusted sources
- GraphQL introspection queries from unauthorized IPs
SIEM Query:
source="web_logs" AND uri="/graphql" AND (status=200 OR status=500) AND user_agent NOT IN ("trusted_agents")