Hasura — Vulnerabilities & Security Advisories 5

Hasura provides a GraphQL engine for building APIs and real-time applications, enabling rapid backend development. Historically, it has faced vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, often stemming from improper input validation and access control flaws. The platform's security posture has been challenged by incidents like CVE-2023-39143, which allowed unauthorized access to GraphQL endpoints, and CVE-2021-39144, enabling RCE through crafted queries. While these issues have been addressed, they highlight risks in default configurations and insufficient input sanitization. Organizations should implement strict access controls and regular security assessments when deploying Hasura to mitigate potential exploitation of its exposed GraphQL interfaces.