Attack Chain

1. The attacker identifies a Saleor e-commerce platform running a vulnerable version (2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118).
2. The attacker crafts a malicious GraphQL query or mutation containing numerous aliased or chained operations. This is done to maximize server-side processing load.
3. The attacker sends the crafted GraphQL request to the Saleor platform’s API endpoint, typically /graphql/.
4. The Saleor server attempts to process all the queries/mutations within the single request.
5. The server resources (CPU, memory, database connections) are rapidly consumed by the excessive processing demand.
6. The server becomes slow and unresponsive, potentially timing out for legitimate user requests.
7. The Saleor e-commerce platform experiences a denial-of-service condition, disrupting service for legitimate customers.
8. The attacker may repeat this process to maintain the denial-of-service state, further impacting business operations.

Impact

Successful exploitation of CVE-2026-35401 leads to resource exhaustion on the Saleor e-commerce platform, resulting in a denial-of-service condition. This disruption can impact online sales, customer experience, and brand reputation. The number of affected systems depends on the prevalence of vulnerable Saleor installations. While the exact number of victims is unknown, any e-commerce business using an unpatched version is susceptible to service outages. Prolonged or repeated attacks can lead to significant financial losses and damage to business operations.

Recommendation

• Immediately upgrade Saleor e-commerce platforms to versions 3.23.0a3, 3.22.47, 3.21.54, or 3.20.118 to patch CVE-2026-35401.
• Implement rate limiting on the /graphql/ API endpoint to mitigate the impact of excessive requests.
• Deploy the Sigma rule Detect Suspicious GraphQL Volume to identify potential exploitation attempts based on request patterns.