CVE-2026-63421 in Keystone
Summary
by MITRE • 08/22/2026
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
Keystone is an open-source content management system built on Node.js that provides a GraphQL API for data access. In versions prior to 6.5.3, the findMany resolver located within the core query handling logic contains a critical input validation flaw regarding pagination parameters. Specifically, the resolver compares the signed take argument directly against graphql.maxTake without first ensuring the value is positive or non-negative. This logical oversight allows an unauthenticated remote attacker to supply a negative integer for the take parameter in GraphQL queries. By providing a negative value whose absolute magnitude exceeds the configured maximum limit, the attacker can bypass the intended pagination restrictions designed to prevent excessive data retrieval and resource exhaustion.
The technical root cause of this vulnerability lies in the comparison logic used within the resolver implementation. Instead of validating that the input is both positive and less than or equal to the maximum allowed value, the system only checks if the signed integer is below the upper bound threshold. Since negative integers are inherently smaller than any positive maximum limit defined by graphql.maxTake, they pass this validation check successfully. Consequently, the underlying database query engine interprets the negative take parameter in a manner that deviates from standard pagination behavior, often resulting in the retrieval of an unintended and potentially massive number of records. This bypass mechanism is not limited to simple entity queries but also extends to relationship queries, amplifying the scope of potential data exposure and system impact.
The operational impact of this vulnerability includes significant resource exhaustion risks and unauthorized data access. By exploiting the negative take parameter, a remote attacker can trigger database operations that return far more records than intended by the developer or administrator. This excessive data retrieval consumes substantial server memory, CPU cycles, and network bandwidth, potentially leading to denial-of-service conditions for legitimate users. Furthermore, because the vulnerability affects relationship queries, it may allow attackers to traverse complex data structures and extract sensitive information from related entities that were not meant to be exposed in bulk quantities. The lack of authentication requirements means this attack vector is accessible to any external actor with network connectivity to the GraphQL endpoint, significantly lowering the barrier for exploitation.
To mitigate this vulnerability, organizations running Keystone CMS must upgrade immediately to version 6.5.3 or later, where the input validation logic has been corrected to properly handle signed integers and enforce strict positive bounds on pagination parameters. For environments that cannot be patched instantly, implementing a Web Application Firewall rule to reject GraphQL queries containing negative values for take arguments can provide temporary protection. Additionally, developers should review their custom resolvers to ensure similar input sanitization practices are applied consistently across all data access points. This issue is categorized under CWE-20 Improper Input Validation and aligns with ATT&CK technique T1595 Active Scanning, as it involves probing system boundaries through malformed inputs to gather information or disrupt service availability.