Vulnerability class
The SQL injection mistake, in the query languages of graph, analytics and search databases.
3 write-ups, 3 vulnerabilities
CVE-2026-35211
6.5 · MediumAny OpenCTI user with the KNOWLEDGE capability could send raw Painless scripts to Elasticsearch through a public filter operator and exhaust the cluster.
CVE-2026-33980
8.3 · HighThree metadata tools of adx-mcp-server pasted table_name into KQL, letting an agent run arbitrary queries without going through execute_query.
CVE-2026-32247
8.1 · HighGraphiti pasted search filter node labels into raw Cypher, allowing a caller to bypass group filtering; writes depend on the database route and permissions.
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-35211 | OpenCTI | Painless script injection through the script filter operator | 6.5 Medium | |
| CVE-2026-33980 | Azure Data Explorer MCP Server | KQL injection through table_name in three metadata tools | 8.3 High | |
| CVE-2026-32247 | Graphiti | Cypher injection through SearchFilters.node_labels | 8.1 High |
