CVE-2026-33326: @keystone-6/core - isFilterable Bypass via Cursor Parameter in findMany
Summary
CVE-2026-33326: {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. Affects @keystone-6/core versions < 6.5.2. Fixed in 6.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone 6 is a powerful open-source framework for building database-driven applications with GraphQL. It provides developers with tools to create schemas, manage data, and implement access control. One of its key features is the ability to define fields as filterable, allowing for fine-grained control over data access. However, a vulnerability has been identified that compromises the integrity of this feature, specifically in the way the framework handles cursor-based pagination in findMany queries.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2025-46720, where the access control for the isFilterable property can be bypassed by using the cursor parameter in findMany queries. This allows unauthorized users to confirm the existence of records based on protected field values, undermining the intended access control mechanisms. The issue affects any project relying on isFilterable behavior to prevent external users from discovering sensitive information through filtering.
How To Fix
Latest published version: 8.1.0 as of 22 Oct 2026
npm install @keystone-6/core@8.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.2
This is the first release that contains the fix.
npm install @keystone-6/core@6.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version, consider implementing the following workarounds: Set the isFilterable property to false for relevant fields statically, preventing filtering by them. Alternatively, you can set the graphql.omit.read property to true for sensitive fields, which will implicitly remove filtering by these fields from your GraphQL schema. Example:
const schema = {
fields: {
sensitiveField: {
type: String,
isFilterable: false,
graphql: { omit: { read: true } }
}
}
};
Conclusion
In summary, CVE-2026-33326 is a significant vulnerability in the @keystone-6/core package that can lead to unauthorized access to sensitive data through cursor-based queries. It is crucial to update to the patched version or implement the suggested workarounds to mitigate the risk.
See every vulnerability recorded for @keystone-6/core →
FAQ
CVE-2026-33326 is a vulnerability in the @keystone-6/core package that allows unauthorized access to filterable fields via cursor-based pagination in findMany queries.
If your application relies on the isFilterable property for access control, this vulnerability could allow unauthorized users to discover sensitive information.
You can implement workarounds by setting isFilterable to false for sensitive fields or omitting them from the GraphQL schema.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code. Visit Vulert Scanner to check your application.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @keystone-6/core.
