Security readout for executives and security teams
Plain-English summary
CVE-2026-1170 is a remotely reachable information disclosure issue in birkir prime’s GraphQL API endpoint. Public sources say versions up to 0.4.0.beta.0 are affected, and a public exploit exists. There is no cited evidence of active exploitation or a vendor fix. Organizations using this beta software should treat internet exposure as urgent to review.
Executive priority
Prioritize review if birkir prime is deployed on internet-facing systems or handles sensitive data. The business risk is unauthorized information exposure, not known system takeover. Because a public exploit exists and no fix is cited, reduce exposure while monitoring for vendor guidance.
Technical view
The issue affects unknown processing in the /graphql component of birkir prime. VulDB describes manipulation leading to information disclosure, mapped to CWE-200 and CWE-284. CVSS v4.0 is 6.9 with network attack vector, low complexity, no privileges, and no user interaction. Reported impact is limited confidentiality loss, with no integrity or availability impact identified.
Likely exposure
Exposure is most likely where birkir prime up to 0.4.0.beta.0 is deployed with the /graphql endpoint reachable by untrusted users, especially from the internet. The source bundle does not identify hosted services, default deployments, package managers, or downstream products using this project.
Exploitation context
The CVE record and VulDB state the exploit is public and may be used. CISA KEV is false in the provided data, and no cited source confirms active exploitation. The project was reportedly notified through an issue report but had not responded at publication time.
Researcher notes
Evidence is thin: affected processing is described as unknown, and the public issue is cited as an exploit reference. Avoid assuming affected schemas, data types, or authentication bypass details beyond the sources. No patch, commit, workaround, or maintainer response is identified in the provided bundle.
Mitigation direction
- Inventory systems for birkir prime, especially version 0.4.0.beta.0 or earlier.
- Restrict untrusted network access to the /graphql endpoint where operationally possible.
- Check the GitHub project and vendor advisories for updates or remediation guidance.
- Review GraphQL exposure, authentication, and authorization controls around sensitive data.
- Monitor application logs for unusual GraphQL access patterns.
Validation and detection
- Confirm whether birkir prime is deployed in your environment.
- Identify deployed versions and compare against affected versions in the CVE record.
- Determine whether /graphql is reachable from the internet or untrusted networks.
- Review access controls for the GraphQL API without using public exploit payloads.
- Track the GitHub issue and CVE references for vendor response or patch information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1170 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341764 | birkir prime GraphQL API graphql information disclosureCVE reference · vdb-entry, technical-description
- VDB-341764 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #731100 | birkir prime <=0.4.0 Sensitive Information DisclosureCVE reference · third-party-advisory
- https://github.com/birkir/prime/issues/541CVE reference · exploit, issue-tracking
- https://github.com/birkir/prime/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.