Attack Chain

1. The attacker identifies a Saleor instance running a vulnerable version (prior to 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118).
2. The attacker crafts a malicious HTTP POST request targeting the GraphQL endpoint (typically /graphql/).
3. The request body contains a JSON array representing a batch of GraphQL queries.
4. The number of GraphQL operations within the array is excessively large, designed to bypass query complexity limits.
5. The Saleor server processes the HTTP request, attempting to execute all GraphQL operations within the batch.
6. Due to the large number of operations, the server’s resources (CPU, memory) become heavily utilized.
7. The server becomes slow or unresponsive to legitimate user requests, causing a denial-of-service condition.
8. The attacker repeats the process to maintain the denial-of-service state, impacting legitimate users.

Impact

Successful exploitation of this vulnerability results in resource exhaustion on the Saleor e-commerce platform. This can lead to slow response times, application instability, and ultimately a denial-of-service condition for legitimate users. This vulnerability poses a significant risk to e-commerce businesses relying on Saleor, potentially impacting sales, customer satisfaction, and overall business operations. The number of potential victims is directly proportional to the number of Saleor installations running vulnerable versions.

Recommendation

• Upgrade Saleor instances to versions 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118 or later to patch CVE-2026-33756.
• Deploy the Sigma rule Detect High Volume of GraphQL Queries to identify potential exploitation attempts by monitoring the number of GraphQL queries within a single HTTP request in web server logs.
• Monitor web server logs for abnormally large HTTP POST requests to the /graphql/ endpoint.
• Implement rate limiting on the GraphQL endpoint to restrict the number of requests from a single IP address within a defined timeframe.