CVE-2026-32247
Getzep Graphiti ≤ 0.28.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2026-32247 is a high-severity Improper Neutralization of Special Elements in Data Query Logic (CWE-943) vulnerability in Getzep Graphiti. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Graphiti, a framework for building and querying temporal context graphs for AI agents, contains a Cypher injection vulnerability (CWE-943) in versions prior to 0.28.2. The issue arises in shared search-filter construction for non-Kuzu backends, where attacker-controlled label values supplied through SearchFilters.node_labels are directly concatenated into Cypher label expressions without validation. Affected backends include Neo4j, FalkorDB, and Neptune; Kuzu is unaffected due to its use of parameterized label handling.
Attackers with low privileges (PR:L) can exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Exploitation is possible through direct untrusted access to the Graphiti MCP server or via prompt injection against an LLM client, inducing it to call search_nodes with attacker-controlled entity_types values. The MCP server maps these to SearchFilters.node_labels, feeding into the vulnerable Cypher path. Successful attacks yield high confidentiality and integrity impacts (C:H/I:H), such as unauthorized data access or modification via injected Cypher queries, with a CVSS v3.1 base score of 8.1.
Mitigation is available in Graphiti version 0.28.2, which addresses the injection by fixing the label handling in search-filter construction. Security practitioners should upgrade to this version immediately. Relevant resources include the security advisory (GHSA-gg5m-55jj-8m5g), the fixing commit (7d65d5e77e89a199a62d737634eaa26dbb04d037), pull request #1312, and the release notes for v0.28.2.
This vulnerability is particularly relevant to AI/ML deployments due to Graphiti's role in AI agent context graphs and the prompt injection vector involving LLMs, though no real-world exploitation has been reported.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11682
Vulnerability Data
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into…
more
Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, llm, mcp, prompt injection
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops unneutralized special elements from reaching query logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require parameterized queries and input neutralization to prevent query-logic injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release but does not itself implement the fix.
Secure development life cycle mandates input validation and query parameterization that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection and improper query construction.
Secure architecture principles reduce the likelihood of query-logic flaws but do not prescribe the specific coding practice.
Secure coding standards require proper neutralization of special elements in all data queries.
Outsourced development agreements can require secure coding practices, indirectly mitigating the weakness.