CVE-2026-1175
📋 TL;DR
This vulnerability in birkir prime's GraphQL Directive Handler allows remote attackers to extract sensitive information through error messages. It affects all systems running birkir prime up to version 0.4.0.beta.0 with the GraphQL component exposed. The exploit is publicly available, increasing the risk of exploitation.
💻 Affected Systems
- birkir prime
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract sensitive system information, configuration details, or internal data structures through verbose error messages, potentially enabling further attacks.
Likely Case
Information disclosure revealing internal system details, API structures, or configuration data that could aid in reconnaissance for additional attacks.
If Mitigated
Limited exposure of non-critical system information with proper error handling and access controls in place.
🎯 Exploit Status
Exploit involves manipulating GraphQL queries to trigger verbose error messages. Public exploit code is referenced in the issue report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor the GitHub repository for updates. Consider upgrading to any future version beyond 0.4.0.beta.0 once available.
🔧 Temporary Workarounds
Disable GraphQL endpoint
allDisable or restrict access to the /graphql endpoint if not required
Configure application to disable GraphQL component or restrict access via firewall/access controls
Implement error message sanitization
allConfigure application to return generic error messages without sensitive details
Configure error handling to return minimal, non-informative error responses
🧯 If You Can't Patch
- Implement network segmentation and restrict access to GraphQL endpoints to trusted sources only
- Deploy a Web Application Firewall (WAF) with rules to detect and block GraphQL information disclosure attempts
🔍 How to Verify
Check if Vulnerable:
Check if running birkir prime version 0.4.0.beta.0 or earlier with GraphQL enabled. Test by sending malformed GraphQL queries to /graphql endpoint and checking for verbose error responses.Check Version:
Check package.json or application configuration for birkir prime versionVerify Fix Applied:
Verify that error messages no longer contain sensitive system information when sending malformed GraphQL queries.📡 Detection & Monitoring
Log Indicators:
- Unusual GraphQL query patterns
- Multiple error responses from /graphql endpoint
- Requests with malformed GraphQL syntax
Network Indicators:
- Unusual traffic to /graphql endpoint
- Repeated GraphQL error responses
SIEM Query:
source="web_server" AND (uri_path="/graphql" AND status_code>=400) | stats count by src_ip