CVE-2026-32247

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32247", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T14:47:05.685Z", "datePublished": "2026-03-12T19:11:29.857Z", "dateUpdated": "2026-03-13T16:17:58.625Z"}, "containers": {"cna": {"title": "Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g"}, {"name": "https://github.com/getzep/graphiti/pull/1312", "tags": ["x_refsource_MISC"], "url": "https://github.com/getzep/graphiti/pull/1312"}, {"name": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037", "tags": ["x_refsource_MISC"], "url": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037"}, {"name": "https://github.com/getzep/graphiti/releases/tag/v0.28.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/getzep/graphiti/releases/tag/v0.28.2"}], "affected": [{"vendor": "getzep", "product": "graphiti", "versions": [{"version": "< 0.28.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T19:11:29.857Z"}, "descriptions": [{"lang": "en", "value": "Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2."}], "source": {"advisory": "GHSA-gg5m-55jj-8m5g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:17:48.028799Z", "id": "CVE-2026-32247", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:17:58.625Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-13T16:17:48.028799Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:17:54.664Z"}}], "cna": {"title": "Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters", "source": {"advisory": "GHSA-gg5m-55jj-8m5g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getzep", "product": "graphiti", "versions": [{"status": "affected", "version": "< 0.28.2"}]}], "references": [{"url": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g", "name": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getzep/graphiti/pull/1312", "name": "https://github.com/getzep/graphiti/pull/1312", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037", "name": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getzep/graphiti/releases/tag/v0.28.2", "name": "https://github.com/getzep/graphiti/releases/tag/v0.28.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T19:11:29.857Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32247", "state": "PUBLISHED", "dateUpdated": "2026-03-13T16:17:58.625Z", "dateReserved": "2026-03-11T14:47:05.685Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T19:11:29.857Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "graphiti", "vendor": "getzep", "versions": [{"status": "affected", "version": "< 0.28.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getzep:graphiti:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F936A08-BA4E-46CE-B94A-5819ACC1C584", "versionEndExcluding": "0.28.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2."}, {"lang": "es", "value": "Graphiti es un framework para construir y consultar grafos de contexto temporal para agentes de IA. Las versiones de Graphiti anteriores a la 0.28.2 conten\u00edan una vulnerabilidad de inyecci\u00f3n Cypher en la construcci\u00f3n compartida de filtros de b\u00fasqueda para backends que no eran Kuzu. Los valores de etiquetas controlados por el atacante, suministrados a trav\u00e9s de SearchFilters.node_labels, se concatenaban directamente en expresiones de etiquetas Cypher sin validaci\u00f3n. En las implementaciones de MCP, esto era explotable no solo a trav\u00e9s del acceso directo no confiable al servidor MCP de Graphiti, sino tambi\u00e9n a trav\u00e9s de la inyecci\u00f3n de prompts contra un cliente LLM que pod\u00eda ser inducido a llamar a search_nodes con valores de entity_types controlados por el atacante. El servidor MCP mapeaba los entity_types a SearchFilters.node_labels, que luego alcanzaban la ruta de construcci\u00f3n Cypher vulnerable. Los backends afectados inclu\u00edan Neo4j, FalkorDB y Neptune. Kuzu no se vio afectado por el problema de inyecci\u00f3n de etiquetas porque utilizaba un manejo de etiquetas parametrizado en lugar de etiquetas Cypher interpoladas por cadena. Este problema se mitig\u00f3 en la 0.28.2."}], "id": "CVE-2026-32247", "lastModified": "2026-06-17T10:35:25.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32247", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:17:48.028799Z", "version": "2.0.3"}}]}, "published": "2026-03-12T19:16:19.733", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/getzep/graphiti/pull/1312"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getzep/graphiti/releases/tag/v0.28.2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.28.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "graphiti", "source": "cna", "vendor": "getzep"}, "product": "graphiti", "vendor": "getzep"}], "analysis": {"en": {"generated_at": "2026-03-18T15:51:13.126993+00:00", "value": {"mitigation_remediation": ["Upgrade Graphiti to version 0.28.2 or later, which removes the unsafe string interpolation of node_labels."], "summary": {"action": "Immediate Patch", "impact": "Cypher Injection leading to data compromise"}, "threat_synthesis": {"affected_systems": "Any deployment of Getzep Graphiti using a version older than 0.28.2 that interacts with non\u2011Kuzu backends (Neo4j, FalkorDB, or Amazon Neptune) is affected. The flaw is triggered when SearchFilters.node_labels contain unsanitized values; it can be exploited via direct API access to the Graphiti MCP server or through prompt injection against an LLM client that causes the client to invoke search_nodes with attacker\u2011controlled entity_types that are mapped to node_labels. Deployments using the Kuzu backend are not vulnerable because Kuzu uses parameterized label handling.", "description_and_impact": "Graphiti is a framework for building and querying temporal context graphs for AI agents. Versions before 0.28.2 of the framework performed unsafe string concatenation of attacker\u2011controlled label values supplied through SearchFilters.node_labels directly into Cypher label expressions. This allows a Cypher injection flaw that can be used to execute arbitrary Cypher statements, potentially reading, modifying or deleting data in the underlying graph database. The vulnerability is rooted in a CWE\u2011943 weakness, an unsafe use of user input in query construction.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote \u2013 an attacker must be able to supply arbitrary node_labels through the public API or to induce the LLM client to send malicious prompt data. Because the flaw permits arbitrary query construction, an attacker could gain data confidentiality, integrity, or availability compromise of the graph database. The overall risk profile is high severity but low exploitation probability."}}}}, "created": "2026-03-13T09:50:11.177923+00:00", "updated": "2026-03-23T09:54:57.054691+00:00", "vendors": ["getzep", "getzep$PRODUCT$graphiti"]}