GHSA-gg5m-55jj-8m5g: Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

Summary

Graphiti versions 0.28.1 and earlier contained a Cypher injection flaw in shared search-filter construction for non-Kuzu backends. Attacker-controlled values in SearchFilters.node_labels were concatenated directly into Cypher label expressions, and in MCP deployments an LLM client could be steered via prompt injection into calling search_nodes with crafted entity_types values. Affected backends were Neo4j, FalkorDB, and Neptune; successful exploitation could read, modify, or delete graph data and bypass logical group isolation.

Mitigation

Fixed in 0.28.2. Upgrade to 0.28.2 or later, which adds validation of SearchFilters.node_labels, label validation in shared search-filter constructors, validation of entity node labels in persistence query builders, and validation of group_ids in shared search fulltext helpers. If upgrading is not possible: do not expose Graphiti MCP tools to untrusted users or to LLM workflows processing untrusted prompt content, avoid passing untrusted values into SearchFilters.node_labels or MCP entity_types, and restrict graph database credentials to the minimum required privileges.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database