GraphQL query injection in the export status lookup of Rapid7 Bulk Export MCP
An MCP tool argument was placed straight into a GraphQL query string, so a crafted identifier could append extra selections to the query. Rated Low, and published because the pattern is common in MCP servers.
- Reference
- CVE-2026-97228
- Rating
- 2.7 Low (CVSS 3.1)
- Class
- CWE-943, improper neutralization in data query logic
- CVE record
- Published 2026-09-25, assigned by Rapid7
- Affected
- Rapid7 Bulk Export MCP 0.2.5 through 0.6.1
- Fixed in
- 0.6.2
- Credit
- Syed Anas Mohiuddin, Independent Researcher, finder
What was wrong
In versions 0.2.5 through 0.6.1, the get_export_status function interpolated export_id, an unvalidated MCP tool argument, directly into the GraphQL query string. It was reachable through the check_rapid7_export_status and download_rapid7_export tools.
An export_id containing quote and brace characters could end the intended export(id: "...") selection early and add attacker-chosen root-level selections, such as schema introspection, in one well-formed GraphQL document.
Why the rating is Low
We state the rating plainly. Every injected query runs inside the operator's own authenticated API scope, with the operator's own key. It cannot cross a tenant or account boundary, and a malicious operator gains nothing they could not do by calling the API directly.
The realistic exposure is a compromised or careless MCP client, or indirect prompt injection that forwards an unvalidated identifier. That is why it is Low, and also why it is worth publishing: the same unvalidated-argument pattern shows up in many MCP servers.
The fix
Version 0.6.2 passes export_id as a parameterized GraphQL variable ($exportId: ID!) instead of building the query as a string.