Keystone GraphQL maxTake Argument Injection

Keystone versions 6.5.2 and earlier contain a vulnerability in the GraphQL layer (CVE-2026-63421) related to input validation of the 'take' argument. The 'take' argument is intended to constrain the number of records returned in a query, which is protected by the 'graphql.maxTake' configuration setting. Attackers can bypass this configuration limit by supplying a negative integer for the 'take' argument, causing the application to return an excessive number of records beyond the defined threshold. This can result in unauthorized mass data exposure or server performance degradation due to resource-heavy queries. The vulnerability was discovered by Haxset and addressed in version 6.5.3 of the @keystone-6/core package.

Impact

Successful exploitation allows for the exfiltration of significantly more data than intended by the application developer. This impacts any Keystone-based application that relies on 'graphql.maxTake' as a security or performance control mechanism to bound database result sets.

Recommendation

• Upgrade the @keystone-6/core package to version 6.5.3 or later across all production deployments.
• If immediate patching is not feasible, implement request validation at the API gateway or WAF layer to block GraphQL queries containing negative values for the 'take' argument.
• Audit existing GraphQL query patterns for abnormally high result counts that may indicate exploitation of this vulnerability.