CVE-2026-32247 Details
Description
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation. In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path. Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels. This issue was mitigated in 0.28.2.
A Cypher injection vulnerability has been identified in Graphiti versions prior to 0.28.2. This issue arises from the way search filters are constructed for non-Kuzu backends. Attacker-controlled label values provided through 'SearchFilters.node_labels' were directly concatenated into Cypher label expressions without proper validation. In Graphiti MCP deployments, this vulnerability could be exploited not only through direct access to the Graphiti MCP server but also by injecting prompts into an LLM client that could be manipulated to call 'search_nodes' with attacker-controlled 'entity_types' values. The affected backends include Neo4j, FalkorDB, and Neptune, while Kuzu was not impacted due to its use of parameterized label handling.
Upgrade to Graphiti version 0.28.2 or later, which includes validation for 'SearchFilters.node_labels' and 'group_ids', and reinforces label validation in shared search-filter constructors. If an immediate upgrade is not possible, avoid using Graphiti MCP tools with untrusted users or LLM workflows that handle untrusted prompts, and restrict graph database credentials to the minimum necessary privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037 | [email protected] | Patch |
| https://github.com/getzep/graphiti/pull/1312 | [email protected] | Issue TrackingPatch |
| https://github.com/getzep/graphiti/releases/tag/v0.28.2 | [email protected] | Release Notes |
| https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getzep graphiti | < 0.28.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | New CVE Received | [email protected] |