112 matches found
CVE-2026-71214
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
CVE-2026-71214
CVE-2026-71214 (NASA-AMMOS plandev sequencing-server) : The authorization middleware in sequencing-server derives the caller’s Hasura session role via getHasuraSession(), preferring a client-supplied session_variables object from the request body over JWT claims in the Authorization header, witho...
CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
EUVD-2026-53211
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
CVE-2026-71214
The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...
Graphql Hasura Detect
Detects Graphql Hasura Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Hasura Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Hasura Detect', 'description': 'Detects Graphql Hasur...
Hasura GraphQL Engine - Remote Code Execution Detection
Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the '/v2/query' endpoint aka remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the...
CVE-2026-54698
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698 Hasura: Row-level authorization bypass on table computed fields
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
EUVD-2026-42118
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698 Hasura: Row-level authorization bypass on table computed fields
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698
Hasura CVE-2026-54698 describes a row-level authorization bypass on table computed fields. Before versions 2.49.2 and 2.45.5, a user could use a where clause on a table computed field (returning SETOF some_table) to infer rows that should be filtered for their role according to some_table’s row-l...
CVE-2026-54698 Hasura: Row-level authorization bypass on table computed fields
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
CVE-2026-54698: Incorrect Authorization
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field returning SETOF sometable to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While...
PT-2026-56262
Name of the Vulnerable Software and Affected Versions Hasura versions prior to 2.49.2 Hasura versions prior to 2.45.5 Description A flaw exists where a user can employ a where clause on a table computed field that returns SETOF some table to infer row values. This occurs even when those rows shou...
CVE-2026-57951
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payloadbuildstep table with an always-satisfied or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payloadbuildstep to read stepstdout, stepstderr, stepname, and...
CVE-2026-57951
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payloadbuildstep table with an always-satisfied or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payloadbuildstep to read stepstdout, stepstderr, stepname, and...