Description

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key. Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-25T11:17:02.163Z",
  "pubdate": "2026-09-25T11:17:02.163Z",
  "executiveSummary": "Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 contain a GraphQL query injection vulnerability within the export-status component.\nThe vulnerability arises from improper input sanitization of the 'export_id' parameter, which is concatenated directly into GraphQL query strings.\nSuccessful exploitation allows an attacker to manipulate the structure of the GraphQL query sent to the Rapid7 export API.\nWhile the injection executes under the scope of the operator's authenticated API key, this flaw poses significant risks if triggered by malicious upstream MCP clients or indirect prompt injection.\nThe vulnerability does not facilitate cross-tenant access but permits unauthorized schema introspection or execution of arbitrary root-level GraphQL selections within the context of the user's current session.\nImpact is primarily concerned with unauthorized data access or information disclosure attainable via the GraphQL API schema, strictly bound by the permissions associated with the operator's credentials.\nThe flaw is remediated in version 0.6.2, which introduces parameterized GraphQL variables to prevent string interpolation-based injection.",
  "technicalDetails": "The vulnerability exists in src/export_manager.py within the get_export_status function, which powers the check_rapid7_export_status and download_rapid7_export tools.\nThe root cause is the insecure handling of the 'export_id' argument, which is interpolated as a raw string into a GraphQL document template rather than being passed through an abstraction layer or variable binding.\nBy providing a crafted 'export_id' containing GraphQL control characters such as double quotes (\") and curly braces ({}), an attacker can terminate the existing query structure prematurely.\nThe injection allows for the appending of secondary, attacker-controlled queries to the document, resulting in a single, syntactically valid GraphQL payload that is subsequently executed by the Rapid7 backend API.\nThe attack flow begins when an MCP client or indirect prompt injection submits a malicious string to the 'export_id' field. The application processes this input without validation, constructing a GraphQL request that may perform operations outside the intended scope of the check_rapid7_export_status function.\nFor example, an attacker could terminate the 'export(id: ...)' selection and inject 'introspection' queries to map the entire GraphQL schema of the underlying Rapid7 API, revealing potentially sensitive query paths or hidden fields.\nBecause the query is dispatched using the operator's API key, the API treats the request as a legitimate, authenticated operation. The system effectively performs unauthorized actions on behalf of the user, who may be unaware that the underlying MCP tool is manipulating the API request structure.\nThe vulnerability is limited to the client-side tool's request generation and does not directly compromise the Rapid7 backend infrastructure; however, it leverages the legitimate trust relationship between the API and the authenticated user to facilitate the execution of unauthorized query selections.\nVersion 0.6.2 mitigates this by replacing raw string interpolation with GraphQL variable injection, using the '$exportId: ID!' syntax. This ensures that the 'export_id' is treated strictly as an argument value rather than as executable structural code within the query document."
}