Executive brief
Keystone is a CMS and data platform that provides GraphQL API query capabilities. A vulnerability in query result limiting allows attackers to bypass the `graphql.maxTake` configuration by submitting negative values, enabling them to retrieve arbitrarily large result sets and potentially cause denial of service through resource exhaustion or data exfiltration.
Technical details
The vulnerability is an input validation flaw (CWE-20) in Keystone's GraphQL query processing, where the `take` parameter does not properly validate against negative values. The root cause appears to involve an incorrect operator condition (CWE-480) that fails to restrict negative inputs. An unauthenticated attacker can send a GraphQL query with a negative `take` parameter to bypass the developer-configured `graphql.maxTake` limit, allowing retrieval of unlimited result sets. This is exploitable over the network with no authentication required and no user interaction needed. The impact is primarily denial of service through resource exhaustion or potential data exposure. The issue was patched in version 6.5.3; users unable to patch can restrict `take` input values or block negative values at the GraphQL layer.
Affected products
- KeystoneJS @keystone-6/core <= 6.5.2
Timeline
- 2026-07-01: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-08-21: advisory: Advisory updated and published
- 2026: patched: Patched in @keystone-6/core version 6.5.3