Not every finding is dramatic. CVE-2026-97228 is rated 2.7, Low, under CVSS 3.1. We published it and we are writing about it, because the weakness is one that shows up across MCP servers and because the honest rating is part of the point.
The bug
In Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1, the get_export_status function took export_id, an MCP tool argument with no validation, and placed it directly into a GraphQL query string. Two tools reached it: check_rapid7_export_status and download_rapid7_export.
export(id: "<export_id goes here>")An export_id containing a quote and braces can close that selection early and add attacker-chosen root-level selections. Schema introspection is the example in the record. The result is one well-formed GraphQL document, sent to the Rapid7 export API under the operator's own key.
Why it is Low
Every injected query runs inside the operator's own authenticated scope. It cannot cross a tenant or account boundary, and an operator who is malicious gains nothing they could not do by calling the API directly. The realistic exposure is a compromised or careless MCP client, or indirect prompt injection that passes an unvalidated identifier along.
Why it is still worth reading
In an MCP server, the model is the caller, and the model reads untrusted text. Any tool argument that ends up inside a query string, a shell command or a URL is an injection point, whether or not this particular server has anything valuable behind it. The same shape of bug in a server with a broader scope would not be Low.
The fix
Version 0.6.2 passes export_id as a parameterized GraphQL variable, $exportId: ID!, and stops building the query as a string. That is the whole fix, and it is the one to copy: treat tool arguments as data, never as syntax.