GraphQL suggestions enabled
Summary: PortSwigger Research describes GraphQL suggestions as an Apollo feature where the server answers invalid queries with suggestions for valid queries of similar syntax. Because attackers can send intentionally invalid queries and collect the suggestions, they can learn the names and structures of valid queries and mutations even when introspection is disabled.
What you should know: A server that helpfully suggests valid queries hands an attacker your schema structure even with introspection turned off, so the error message itself becomes the disclosure channel.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026