Read the docs
TI-2026-84494 Aliases CVE-2026-63489

AQL injection in Yeti search sorting and filter parameters

Priority LOW 33CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Yeti through 2.5.0 builds ArangoDB AQL queries from user-controlled sorting fields and filter_aliases attribute paths without validation. An authenticated low-privileged user can send crafted values to several search endpoints, causing attacker-controlled AQL subexpressions to be evaluated. The flaw is an improper neutralization of special elements in data query logic (CWE-943) and can expose an error oracle, reveal schema details, alter search logic and consume excessive database resources, but it does not allow arbitrary database writes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.

Why it matters now

EPSS 0.00256 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
yeti-platformyetiup to 2.5.0—No fix listedCNA
  • yeti Vendoryeti-platform Affected up to 2.5.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version as of this review.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63489
  2. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2024-31003 yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the… CVSS 3.1HIGH 7.5
  • TI-2026-62524 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion CVSS 4.0HIGH 7.2
  • TI-2024-31002 A SSTI (server side template injection) vulnerability in the custom template export… CVSS 3.1HIGH 7.3
  • TI-2026-84493 Missing authentication in Yeti exposes full audit timeline CVSS 3.1HIGH 7.5
  • TI-2026-84497 Path traversal in Yeti export task names allows file read and write CVSS 3.1HIGH 8.3
  • TI-2024-30461 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences