TigerGraph - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/tigergraph/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 01 Oct 2026 15:12:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in TigerGraph Community Edition via Default Credentialshttps://feed.craftedsignal.io/briefs/2026-10-tigergraph-rce/Thu, 01 Oct 2026 15:12:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tigergraph-rce/TigerGraph Community Edition 4.2.4 contains a remote code execution chain initiated by hard-coded default credentials, enabling an arbitrary file write that allows for SSH key injection.TigerGraph Community Edition 4.2.4 is susceptible to a full remote code execution chain due to multiple architectural security flaws. The vulnerability begins with the use of hard-coded default credentials (tigergraph:tigergraph) on the GUI administration port (14240), which lacks enforcement for password rotation. An attacker who authenticates can access the GUI's reverse-proxy to the GSQL service on port 8123 to install a malicious query capable of writing arbitrary files to the underlying Linux host. Because the REST++ interface on port 9000 fails to authenticate requests, this file-write primitive can be triggered by unauthenticated remote users. By targeting the '/home/tigergraph/.ssh/authorized_keys' file, an attacker can append a controlled public key, subsequently gaining persistent shell access as the 'tigergraph' OS user via SSH.

Attack Chain

  1. Attacker authenticates to the TigerGraph GUI on port 14240 using the default hard-coded credentials 'tigergraph:tigergraph'.
  2. Attacker leverages the GUI's proxy to the internal GSQL service (port 8123) to install a custom GSQL query, defined with a FILE parameter that provides an unrestricted arbitrary file write primitive.
  3. Attacker triggers the newly installed GSQL query via the REST++ interface on port 9000, which operates without requiring authentication.
  4. Attacker submits a request to the REST++ endpoint, specifying the destination path as '/home/tigergraph/.ssh/authorized_keys'.
  5. The server writes the attacker-supplied public key into the 'authorized_keys' file on the host filesystem.
  6. Attacker initiates an SSH connection to port 22 of the target, authenticating using the private key corresponding to the public key injected in the previous step.
  7. Attacker successfully gains an interactive shell session as the 'tigergraph' user, enabling further lateral movement or data exfiltration.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain persistent unauthorized access to the host operating system with the privileges of the 'tigergraph' service account (UID 1001). This impact includes complete control over the TigerGraph database environment, the ability to read or modify sensitive database information, and the potential for lateral movement within the network from the compromised host.

Recommendation

  • Immediately change the default 'tigergraph' administrative password on all exposed instances.
  • Restrict network access to the administration GUI (port 14240), the REST++ interface (port 9000), and the SSH port (22) to authorized management subnets only.
  • Review the directory permissions for the '/home/tigergraph/.ssh/' directory to ensure only the owner can modify 'authorized_keys'.
  • Monitor access logs on port 14240 for credential-based logins and port 9000 for unexpected REST++ query executions.
  • Disable SSH public key authentication for the 'tigergraph' user if it is not explicitly required for administrative operations.
]]>highthreatremote-code-executiondefault-credentialsprivilege-escalation