Attack Chain

1. The attacker identifies a Graphiti endpoint (create/update/delete) accessible to untrusted users.
2. The attacker crafts a malicious JSONAPI payload containing arbitrary relationship names.
3. The malicious payload is submitted to the Graphiti endpoint.
4. Graphiti::Util::ValidationResponse#all_valid? processes the payload and recursively calls model.send(name) using the attacker-controlled relationship names.
5. The attacker leverages the ability to call arbitrary public methods on the model instance, class, or associated instances/classes.
6. The attacker executes a destructive or malicious method, such as deleting data, modifying configurations, or executing arbitrary code.
7. The application state is altered based on the executed method, potentially leading to data loss, privilege escalation, or complete system compromise.

Impact

Successful exploitation of this vulnerability (CVE-2026-33286) can lead to arbitrary method execution on the server, potentially resulting in complete system compromise. Attackers could delete data, modify configurations, escalate privileges, or even execute arbitrary code on the affected system. The vulnerability affects any application exposing Graphiti write endpoints to untrusted users. The severity is high due to the potential for remote code execution and data corruption.

Recommendation

• Upgrade to Graphiti v1.10.2 to patch the vulnerability (CVE-2026-33286).
• Implement strong authentication and authorization checks before processing any write operation on Graphiti endpoints.
• Apply strong parameter filtering (e.g., Rails strong parameters) to ensure only valid parameters are processed, mitigating the risk of arbitrary method calls.
• Monitor web server logs for suspicious POST requests containing unusual or unexpected relationship names in JSONAPI payloads. Deploy the Sigma rules provided to detect this activity.