Medium severity5.3OSV Advisory· Published Dec 22, 2025· Updated Jun 17, 2026
CVE-2021-47715
CVE-2021-47715
Description
Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4v1.0.0-alpha0, v1.0.0-alpha01, v1.0.0-alpha02, …+ 2 more
- (no CPE)range: v1.0.0-alpha0, v1.0.0-alpha01, v1.0.0-alpha02, …
- cpe:2.3:a:hasura:graphql_engine:1.3.3:*:*:*:*:*:*:*
- (no CPE)range: <1.3.3
Patches
Vulnerability mechanics
References
2- www.exploit-db.com/exploits/49791nvdExploit
- www.vulncheck.com/advisories/hasura-graphql-server-side-request-forgery-via-remote-schema-injectionnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.