CVE-2026-63421
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set. # Impact This affects any project relying on `graphql.maxTake` to bound the number of items returned per query. # Patches This issue has been patched in `@keystone-6/core` version `6.5.3`. If you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values. # Credit This issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.
Properties
- ghsa_id
- GHSA-cqmq-8755-7xvh
- severity
- high
- summary
- Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
- cvss_score
- 7.5
- cve_id
- CVE-2026-63421
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- is_ghsa_only
- false
- ghsa_published
- 2026-08-21T20:55:11Z
- source_url
- https://github.com/advisories/GHSA-cqmq-8755-7xvh
- ghsa_updated
- 2026-08-21T20:55:12Z
Related Entities (5)
VULNERABLE_TO (1)
AFFECTS (1)
HAS_WEAKNESS (2)
REPORTED_BY (1)
Explore deeper with Ninja Signal's threat intelligence graph