Security readout for executives and security teams
Plain-English summary
CVE-2026-1171 affects birkir prime up to 0.4.0.beta.0. A remote user can manipulate the GraphQL endpoint and cause a denial of service. Public sources say exploit details have been published, but they do not show confirmed active exploitation.
Executive priority
Treat this as a moderate operational risk for affected GraphQL-facing services. Prioritize inventory and exposure reduction because public exploit information exists, but urgency is lower than confirmed exploited or data-impacting vulnerabilities.
Technical view
The flaw is in the /graphql GraphQL Field Handler, with the vulnerable function unspecified. VulDB maps it to CWE-404 and CVSS 4.0 score 6.9. Attack vector is network, low complexity, no privileges, no user interaction, with low availability impact.
Likely exposure
Exposure is most relevant where birkir prime versions up to 0.4.0.beta.0 are deployed and /graphql is reachable by untrusted users or the internet.
Exploitation context
The source bundle states an exploit has been published and may be used. It is not listed in KEV, and no cited source confirms active exploitation in the wild.
Researcher notes
Evidence is limited. The advisory names the component and endpoint but not the exact function. The project was reportedly notified through an issue and had not responded at publication. No official patch is cited in the provided sources.
Mitigation direction
- Identify any deployments of birkir prime up to 0.4.0.beta.0.
- Check the GitHub project and vendor channels for an official fix or guidance.
- Restrict untrusted access to /graphql where business requirements allow.
- Apply general GraphQL denial-of-service protections such as rate limits and request complexity controls.
- Monitor /graphql for abnormal request volume or repeated malformed GraphQL activity.
Validation and detection
- Confirm the installed birkir prime version in each environment.
- Determine whether /graphql is reachable from the internet or untrusted networks.
- Review logs for availability errors or unusual GraphQL request patterns.
- Track GitHub issue 542 and VulDB updates for remediation status.
- Verify compensating controls are enforced before considering exposure reduced.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1171 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-341765 | birkir prime GraphQL Field graphql denial of serviceCVE reference · vdb-entry, technical-description
- VDB-341765 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #731101 | birkir prime <=0.4.0 GraphQL Field Duplication VulnerabilityCVE reference · third-party-advisory
- https://github.com/birkir/prime/issues/542CVE reference · exploit, issue-tracking
- https://github.com/birkir/prime/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.