{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/keystone/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-63421"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Keystone Core (6.5.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Keystone"],"content_html":"\u003cp\u003eKeystone versions 6.5.2 and earlier contain a vulnerability in the GraphQL layer (CVE-2026-63421) related to input validation of the 'take' argument. The 'take' argument is intended to constrain the number of records returned in a query, which is protected by the 'graphql.maxTake' configuration setting. Attackers can bypass this configuration limit by supplying a negative integer for the 'take' argument, causing the application to return an excessive number of records beyond the defined threshold. This can result in unauthorized mass data exposure or server performance degradation due to resource-heavy queries. The vulnerability was discovered by Haxset and addressed in version 6.5.3 of the @keystone-6/core package.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the exfiltration of significantly more data than intended by the application developer. This impacts any Keystone-based application that relies on 'graphql.maxTake' as a security or performance control mechanism to bound database result sets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @keystone-6/core package to version 6.5.3 or later across all production deployments.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, implement request validation at the API gateway or WAF layer to block GraphQL queries containing negative values for the 'take' argument.\u003c/li\u003e\n\u003cli\u003eAudit existing GraphQL query patterns for abnormally high result counts that may indicate exploitation of this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T01:17:37Z","date_published":"2026-08-22T01:17:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-keystone-graphql-bypass/","summary":"The Keystone @keystone-6/core package is vulnerable to a GraphQL input validation flaw, CVE-2026-63421, where negative values in the 'take' argument bypass configured result limits.","title":"Keystone GraphQL maxTake Argument Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-keystone-graphql-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Keystone","version":"https://jsonfeed.org/version/1.1"}