Rapid7 Bulk Export MCP CVE-2026-97228

Requires the Rapid7 Bulk Export MCP server (versions 0.2.5 through 0.6.1) to be deployed and configured with a valid Rapid7 API key, and the attacker must be able to influence the export_id argument passed to the check_rapid7_export_status or download_rapid7_export MCP tools - realistically via a compromised/careless upstream MCP client or indirect prompt injection forwarding an unvalidated identifier. Limiting factors: all injected queries execute only within the operator's own already-authenticated API scope and cannot cross a tenant or account boundary, so a directly-malicious operator gains nothing beyond calling the API directly; impact is confined to confidentiality (e.g. schema introspection) with no integrity or availability effect. Fixed in 0.6.2, which passes export_id as a parameterized GraphQL variable.

This is a low-priority, high-nuance issue whose signals are internally consistent: the NVD CVSS of 2.7 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) correctly reflects that exploitation runs entirely within the operator's own already-authenticated Rapid7 API scope and cannot cross a tenant or account boundary - a directly-malicious operator gains nothing they could not already do. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all exploitation signals point the same direction as the low base score. The one genuinely interesting risk driver is not captured cleanly by the CVSS vector: because this is an MCP tool, the realistic exposure is a compromised/careless upstream MCP client or indirect prompt injection that forwards an unvalidated export_id, meaning the practical 'attacker' may be low- or zero-privilege even though the injected query executes under the operator's high-privilege API key. Impact is confined to confidentiality (C:L, e.g. GraphQL schema introspection) with no integrity or availability effect. Bottom line: real but minor - patch during normal maintenance; not an emergency.

An operator runs the Rapid7 Bulk Export MCP server (0.2.5-0.6.1) and an upstream LLM client is steered by indirect prompt injection to invoke check_rapid7_export_status or download_rapid7_export with a crafted export_id containing quote and brace characters. The malicious identifier terminates the intended export(id: "...") selection early and appends attacker-controlled root-level GraphQL selections (such as schema introspection), which execute under the operator's own valid API key. No public exploit code is known, and the attack yields no cross-tenant access - only information reachable within the operator's existing API scope.