Harnessing LLMs for Automating BOLA Detection
Summary: Unit 42 Palo Alto Networks published research on BOLABuster, a methodology that uses large language models to automate detection of broken object level authorization (BOLA) vulnerabilities, generating test cases from an API's OpenAPI Specification 3 input across five stages. The approach uncovered CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 vulnerable endpoints in Easy!Appointments, with human validation retained to verify AI-flagged results.
Bottom line: BOLA has resisted SAST, DAST and fuzzing, leaving manual review as the standard approach - and the same LLM reasoning that found these flaws in Grafana, Harbor and Easy!Appointments can be pointed by adversaries at zero-days faster than manual audit cycles allow.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026