CVE-2026-10802

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6
https://github.com/keystonejs/keystone/
https://github.com/keystonejs/keystone/issues/9789
https://github.com/keystonejs/keystone/pull/9831
https://vuldb.com/cve/CVE-2026-10802
https://vuldb.com/submit/831461
https://vuldb.com/vuln/368251
https://vuldb.com/vuln/368251/cti

Configurations

No configuration.

History

22 Jul 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue detectada en keystonejs keystone hasta 20260319. Esta vulnerabilidad afecta código desconocido en la biblioteca packages/core/src/lib/core/queries/output-field.ts del componente GraphQL API Endpoint. La manipulación resulta en consumo de recursos. Es posible lanzar el ataque de forma remota. El exploit es ahora público y puede ser utilizado. La pull request para solucionar este problema espera aceptación.

04 Jun 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-04 12:16

Updated : 2026-07-22 20:10

NVD link : CVE-2026-10802

Mitre link : CVE-2026-10802

CVE.ORG link : CVE-2026-10802

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2026-10802", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10802", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T12:31:14.916360Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:*:*:*"], "vendor": "keystonejs", "modules": ["GraphQL API Endpoint"], "product": "keystone", "versions": [{"status": "affected", "version": "20260319"}]}]}], "published": "2026-06-04T12:16:24.267", "references": [{"url": "https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6", "source": "cna@vuldb.com"}, {"url": "https://github.com/keystonejs/keystone/", "source": "cna@vuldb.com"}, {"url": "https://github.com/keystonejs/keystone/issues/9789", "source": "cna@vuldb.com"}, {"url": "https://github.com/keystonejs/keystone/pull/9831", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-10802", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/831461", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368251", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368251/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en keystonejs keystone hasta 20260319. Esta vulnerabilidad afecta c\u00f3digo desconocido en la biblioteca packages/core/src/lib/core/queries/output-field.ts del componente GraphQL API Endpoint. La manipulaci\u00f3n resulta en consumo de recursos. Es posible lanzar el ataque de forma remota. El exploit es ahora p\u00fablico y puede ser utilizado. La pull request para solucionar este problema espera aceptaci\u00f3n."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "cna@vuldb.com"}