Catalog/VULNERABILITY/graphql-security
SCAN-ID: GRAPHQL-SECURITYREVISION 2026.4
VULNERABILITYCVSS 7.7 (HIGH)

GraphQL Security Scanner

Audit GraphQL endpoints for public introspection schemas, circular query DoS, and field-level auth leaks.

Technical Scope & Verification Behavior

Queries __schema introspection in production, builds recursive nested queries to test depth limiting, and validates batch request throttling.

Automated Inspection Checks (10)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

{ __schema { types { name fields { name } } } }

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Disable Introspection in Production

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
const server = new ApolloServer({ typeDefs, resolvers, introspection: true });
+++ b/handler.typescript (Remediated)
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: process.env.NODE_ENV !== 'production'
});

Disable GraphQL introspection in production environments to avoid leaking full schema and hidden admin queries.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Disable GraphQL schema introspection in production and install depth-limiting middleware."

Run Isolated Check

Test your public domain specifically for GraphQL Security Scanner.

100% passive • No server load

Specification Details

CVSS Score
7.7 / 10.0
Severity Level
HIGH
Category
VULNERABILITY
Test Vectors
10 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#GraphQL#Schema#Introspection#DoS

Run continuous monitoring for GraphQL Security Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog