CVE-2021-47715 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection
Attackers can inject malicious remote schema URLs to access internal network resources via the add_remote_schema endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-47715?
CVE-2021-47715 is a medium-severity server-side request forgery vulnerability in Hasura GraphQL, published on 22 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.
Weakness: CWE-918
Which versions are affected by CVE-2021-47715?
It affects 1 product.
Products include Hasura Graphql Engine.
How do I fix CVE-2021-47715?
No fix has been published for CVE-2021-47715 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-47715 being exploited?
There is no known exploitation of CVE-2021-47715 in the wild and no public exploit code.
Other vulnerabilities in Hasura GraphQL
- CVE-2021-47748 Hasura GraphQL 1.3.3 - Remote Code Execution
- CVE-2022-46792 Missing authorization in n/a
- CVE-2021-47713 Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query
- CVE-2023-27588 Unauthenticated path traversal vulnerability in Hasura GraphQL Engine
- CVE-2019-1020015 Auth bypass in graphql-engine
Sources
Also known as GHSA-8p9c-w6fc-vjgh.