Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck

CVE-2021-47715Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

Medium 5.3

In plain English

A medium-severity server-side request forgery in Hasura GraphQL from Hasura. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.

Affected products (as reported)

Vendor	Product	Versions
Hasura	Hasura GraphQL	1.3.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

ExploitDB-49791 exploit
Hasura GraphQL Engine GitHub Repository product
VulnCheck Advisory: Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection third-party-advisory