Graphiti
CVE-2026-32247
HIGH
GHSA-gg5m-55jj-8m5g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious node_labels in SearchFilter
-
ExploitInject Cypher syntax into label expressions
-
ExecutionExecute arbitrary Cypher queries
-
ImpactAccess/modify graph database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Query language parameterization
|
| Exploitation Conditions | Graphiti versions before 0.28.2 with non-Kuzu backends (Neo4j, etc.). Requires authenticated access (PR:L) to Graphiti MCP server or ability to inject prompts into LLM client connected to MCP server that processes search_nodes calls. |
| Impact | Severity: High (8.1/10.0) No EPSS data available yet Remotely exploitable with low-privilege access — any authenticated user could exploit this Patch is available — prioritize updating to the fixed version |
| Exploit ScenarioDerived | An authenticated attacker with low-level access can exploit this vulnerability remotely to escalate privileges or access unauthorized resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
High severity vulnerability in Graphiti. #
RemediationAI
Patches available:
- https://github.com/getzep/graphiti/pull/1312
- https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037
Security advisories:
- https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g
Update to the latest patched version as soon as possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vulnerability Type: Improper Neutralization of Special Elements in Data Query Logic (CWE-943) CVSS 3.1: 8.1/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: Low | User Interaction: None Attack Techniques: Authentication Bypass Source: https://github.com/getzep/graphiti Authentication bypass allows attackers to access protected resources without valid credentials.
Know when Graphiti gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2.
Executive ViewAI
A high-severity vulnerability (CVE-2026-32247) in Graphiti with a CVSS score of 8.1 has been publicly disclosed with working exploits available, creating immediate risk to any organization using this software. Without an available patch, this vulnerability poses a significant threat to system confidentiality, integrity, or availability and requires urgent mitigation action.
Implement Web Application Firewall (WAF) rules to detect and block CVE-2026-32247 exploitation patterns; segment Graphiti systems from critical infrastructure using network controls; disable or restrict access to vulnerable Graphiti features; enforce strict input validation and output encoding at application layer; increase logging and monitoring for exploitation attempts; restrict network access via IP whitelisting to trusted sources only; consider running Graphiti in a containerized environment with reduced privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
NoSQL injection exploits databases that don't use traditional SQL syntax-like MongoDB, CouchDB, or Redis-by manipulating queries through unsanitized user input.
Exploit-DB