CVE-2026-97228: Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (getexportstatus in src/exportmanager.py), whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and downloadrapid7export tools — is interpolated directly into the GraphQL query string. A crafted exportid containing quote and brace characters can terminate the intended export(id: "...") selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key.
Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes exportid as a parameterized GraphQL variable ($exportId: ID!).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rapid7 Bulk Export MCPto a version that resolves this vulnerability.Fixed in 0.6.2
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The realistic exposure is an operator whose upstream MCP client is compromised or careless. A directly malicious operator does not gain capabilities beyond what they already have through their own Rapid7 API access.
What must an attacker control to exploit it?
They must be able to supply a crafted export_id value to the check_rapid7_export_status or download_rapid7_export tool. The value must contain characters such as quotes and braces that alter the GraphQL document.
Does successful exploitation allow access to another tenant or account?
No. Injected queries execute using the operator's existing valid API key and remain within that operator's already-authenticated API scope; they cannot cross a tenant or account boundary.
How can I determine whether my deployment is affected?
Deployments running Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are affected. The vulnerable path is the get_export_status function in src/export_manager.py when reached through the export-status or download tools.