TI-2023-12298 Aliases CVE-2023-27588

Unauthenticated path traversal vulnerability in Hasura GraphQL Engine

MEDIUM 41CWE-22Published 2023-03-14 · Updated 2025-02-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01302 70th percentileScored 2026-11-07

Fix Fixed graphql-engine (hasura): 1.3.4, 2.11.5, 2.20.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hasura	graphql-engine	before 1.3.4; 2.0.0 to before 2.11.5; 2.2.0 to before 2.20.1	1.3.4, 2.11.5, 2.20.1	Patch available	CNA

graphql-engine VendorHasura Affected before 1.3.4; 2.0.0 to before 2.11.5; 2.2.0 to before 2.20.1 Fixed in 1.3.4, 2.11.5, 2.20.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hasura:graphql_engine::::::::	before 1.3.4; 2.0.0 to before 2.11.5; 2.12.0 to before 2.20.1	Vulnerable	Hasura

cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:* Versions before 1.3.4; 2.0.0 to before 2.11.5; 2.12.0 to before 2.20.1 Vulnerable ·Hasura

Remediation

Fix · CNA graphql-engine (hasura) Fixed in 1.3.4, 2.11.5, 2.20.1

Timeline

2026-10-02 Threatist record created from CVE-2023-27588

References

Patch 1

https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158

Advisory 1

https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x

Other 4

TI-2021-22365 Hasura GraphQL 1.3.3 - Remote Code Execution CVSS 4.0CRITICAL 9.3
TI-2021-22330 Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query CVSS 4.0HIGH 8.7
TI-2021-22331 Hasura GraphQL 1.3.3 Local File Read via SQL Injection CVSS 4.0MEDIUM 6.9
TI-2022-23138 Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many… CVSS 3.1HIGH 8.8
TI-2021-22332 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection CVSS 4.0MEDIUM 6.9
TI-2019-16093 graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT. CVSS 3.0HIGH 7.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences