Rapid7 Platform vulnerabilities

Latest Rapid7 Platform CVEs

Newest publication first

1. CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

   Published 2026-09-25

   Low·CVSS 2.7 EPSS 0.25%

   Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (get_export_status in src/export_manager.py), whereby the export_id value — an unvalidated MCP tool argument reaching the function via the check_rapid7_e...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.