high · 7.5CVE-2026-63421Aug 21, 2026

CVE-2026-63421: @keystone-6/core graphql.maxTake Bypass via Negative take

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Keystone's query result limit can be completely bypassed by passing a negative number to the GraphQL 'take' argument, letting any caller pull more records than the developer intended to allow.

Package@keystone-6/core
Ecosystemnpm
Affected<= 6.5.2
Fixed in6.5.3
CVE-2026-63421: @keystone-6/core graphql.maxTake Bypass via Negative take

The problem

Keystone exposes a graphql.maxTake config option so developers can cap the number of records returned per list query.

The guard used a simple greater-than comparison (take > maxTake). Negative values pass that check because -1 is never greater than a positive maxTake. Prisma accepts negative take as a 'take from the end' directive, so the query runs uncapped against the database.

Proof of concept

A working proof-of-concept for CVE-2026-63421 in @keystone-6/core, with the exact payload below.

graphql
# With maxTake set to e.g. 100, send take: -9999 to bypass it entirely.
# All records will be returned, no error is thrown.

query {
  users(take: -9999) {
    id
    email
    password
  }
}

The CWE is 'Use of Incorrect Operator': the pre-patch check was effectively if (take > maxTake) throw, which only catches positive overages. A negative take value is mathematically less than maxTake, so the check is silently skipped.

Prisma's take argument treats negative integers as a reverse-direction pagination hint, so the database still executes the query and returns rows. The patch (PR #9859, commit 9fb88b2) added a negative-value guard, rejecting any take less than zero or comparing against Math.abs(take), closing both directions.

The fix

Upgrade to @keystone-6/core version 6.5.3 (patch commit 9fb88b246950ce4de754a43fe6416f20403577b1, PR #9859). If you cannot upgrade immediately, add a custom validator to your GraphQL resolvers that rejects any take value below zero, or apply Keystone's access-control hooks to enforce a minimum take of 0.

Reported by Haxset Security Scanner.

References: [1][2][3][4][5]

Related research