Medium, CVSS 6.5GoPublished
kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution
GHSA-h9mw-h4qc-f5jf
- Affected
- Go github.com/platform-mesh/kubernetes-graphql-gateway <= 1.2.8
- Fixed in
- 1.2.9· Vendor fix available
- Issue
- CVSS 6.5 Medium — The GraphQL API served by kubernetes-graphql-gateway is vulnerable to Denial-of-Service (DoS) attacks due to a complete absence of query resource controls (depth limiting, complexity analysis, response size capping, and rate limiting). An authenticated attacker can craft queries that force the server to compute and serialize multi-megabyte responses, consuming significant CPU, memory, and network bandwidth. Repeated requests can exhaust server resources and degrade or deny service to legitimate users. Note: A previous version of this advisory (based on pre-v1 code) documented an unauthenticated attack surface via an HTTP GET method bypass in the former registry.go. That bypass has been removed in v1 — all requests now require a Bearer token. The CVSS score has been adjusted from 7.5 to 6.5 accordingly (Privileges Required: None → Low). CWE-306 (Missing Authentication for Critical Function) no longer applies. Root Cause The kubernetes-graphql-gateway uses the…
Recommended action: Upgrade to 1.2.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.