Sign in
Deutsch English Español Polski
High

Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

  • Disclosed: 21.08.2026
  • Updated: 11.10.2026 10:22

Summary

The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set.

Impact

This affects any project relying on graphql.maxTake to bound the number of items returned per query.

Patches

This issue has been patched in @keystone-6/core version 6.5.3.

If you cannot patch, you can workaround this by restricting take input values in your GraphQL queries to the bounded value, or by blocking negative values.

Credit

This issue was found by Haxset's Security Scanner and validated by their team.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package @keystone-6/core < 6.5.3 6.5.3

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-20, CWE-480
Platform
npm
Package
@keystone-6/core
Disclosed
21.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cqmq-8755-7xvh - CC BY 4.0

Vulnerability history: @keystone-6/core

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
8
First → latest
10.2022 08.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 1
  • Medium 2
  • Low 3

Disclosures per year

  1. Keystone vulnerable to `graphql.maxTake` bypass with negative `take` this entry
    High · 7.5 CVE-2026-63421 < 6.5.3 6.5.3
  2. Keystone: GraphQL API Endpoint Lacks Query Depth Limits
    Low · 4.3 CVE-2026-10802 <= 6.5.3 no fix
  3. @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (CVE-2025-46720 incomplete fix)
    Medium · 4.3 CVE-2026-33326 < 6.5.2 6.5.2
  4. Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
    Low · 3.1 CVE-2025-46720 < 6.5.0 6.5.0
  5. When `ui.isAccessAllowed` is `undefined`, the `adminMeta` GraphQL query is publicly accessible
    Medium · 5.3 CVE-2023-40027 < 5.5.1 5.5.1
  6. @keystone-6/core's bundled cuid package known to be insecure
    Low ghsa-5fp6-4xw3-xqq3 <= 5.3.1 no fix
  7. @keystone-6/core's NODE_ENV defaults to development with esbuild
    Critical · 9.8 CVE-2022-39382 >= 3.0.0, < 3.0.2 3.0.2
  8. Field-level access-control bypass for multiselect field
    Critical · 9.1 CVE-2022-39322 >= 2.2.0, < 2.3.1 2.3.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.