CVE-2021-47748: 
Hasura vulnerability analysis and mitigation

CVE-2021-47748 is a remote code execution (RCE) vulnerability in Hasura GraphQL Engine version 1.3.3 that allows unauthenticated attackers to execute arbitrary shell commands via SQL query manipulation. The flaw resides in the run_sql endpoint, where attackers can craft malicious GraphQL queries that leverage PostgreSQL's COPY FROM PROGRAM functionality to execute system-level commands. The CVE was assigned by VulnCheck and published on January 21, 2026, despite the CVE identifier year suggesting earlier discovery. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (NVD, VulnCheck Advisory).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection). The attack vector is network-accessible with no authentication required, no user interaction needed, and low attack complexity. Specifically, the run_sql endpoint in Hasura GraphQL Engine 1.3.3 fails to properly sanitize or restrict SQL input, allowing an attacker to pass a crafted SQL statement that invokes PostgreSQL's COPY FROM PROGRAM clause — a feature that executes an OS-level shell command and reads its output as SQL data. A public exploit is available on Exploit-DB (EDB-49802) (NVD, Exploit-DB, VulnCheck Advisory).

Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary OS commands on the host running Hasura GraphQL Engine 1.3.3, resulting in complete system compromise. This includes full confidentiality impact (unauthorized access to sensitive data and secrets), full integrity impact (modification or deletion of data and system files), and full availability impact (disruption or destruction of services). Given the unauthenticated, network-accessible nature of the vulnerability, it poses a severe risk to any internet-exposed Hasura instance and could serve as an initial foothold for lateral movement within a broader network (VulnCheck Advisory, NVD).

A public exploit for this vulnerability is available on Exploit-DB (EDB-49802), referenced directly in the NVD entry and VulnCheck advisory (Exploit-DB, NVD). The EPSS score is approximately 0.316%, indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. No confirmed in-the-wild exploitation or specific threat actor attribution has been reported at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though it was referenced in a CISA vulnerability bulletin for the week of January 19, 2026 (CISA Bulletin).

1. Reconnaissance: Identify internet-facing Hasura GraphQL Engine instances running version 1.3.3 using tools like Shodan, Censys, or by fingerprinting the GraphQL endpoint (e.g., querying /__health or introspecting the schema).
2. Locate the run_sql endpoint: Confirm the target exposes the /v1/query or /v2/query endpoint with run_sql functionality, which is used to execute raw SQL against the connected PostgreSQL database.
3. Craft malicious GraphQL/SQL payload: Construct a run_sql request embedding a PostgreSQL COPY FROM PROGRAM statement, e.g.:

{
  "type": "run_sql",
  "args": {
    "sql": "COPY (SELECT '') TO PROGRAM 'id > /tmp/pwned'"
  }
}

4. Send the request: Submit the crafted HTTP POST request to the Hasura run_sql endpoint without any authentication credentials.
5. Achieve command execution: The PostgreSQL backend executes the injected OS command via COPY FROM PROGRAM, returning output or writing results to an attacker-controlled location, enabling reverse shell establishment, data exfiltration, or further system compromise (Exploit-DB, VulnCheck Advisory).

• Network: Unexpected HTTP POST requests to /v1/query or /v2/query endpoints containing run_sql with COPY FROM PROGRAM or COPY TO PROGRAM SQL keywords; outbound connections from the Hasura/PostgreSQL host to unknown external IPs or C2 infrastructure.
• Logs: Hasura access logs showing unauthenticated run_sql requests with unusual SQL payloads; PostgreSQL logs (pg_log) recording COPY FROM PROGRAM or COPY TO PROGRAM statements from the Hasura service account.
• File System: Unexpected files written to /tmp/ or other world-writable directories by the PostgreSQL process; new cron jobs, SSH authorized keys, or scripts created by the postgres OS user.
• Process: Unusual child processes spawned by the postgres process (e.g., /bin/sh, bash, curl, wget, nc, python) visible in process trees; unexpected network listeners opened by the database process.

Organizations running Hasura GraphQL Engine 1.3.3 should upgrade to a patched version immediately; however, specific patched version numbers have not been publicly confirmed in available advisories — consult the Hasura GitHub repository and release notes for the latest secure release. As interim mitigations: restrict or disable access to the run_sql endpoint if not operationally required; implement network segmentation to prevent unauthenticated external access to the Hasura API; apply strict input validation and query allowlisting on GraphQL requests; and disable PostgreSQL's COPY FROM PROGRAM functionality at the database level if supported by your configuration. Monitor system and database logs for suspicious SQL execution patterns (VulnCheck Advisory, Hasura GitHub).

The vulnerability was assigned and disclosed by VulnCheck in January 2026 and was referenced in a CISA vulnerability summary bulletin for the week of January 19, 2026 (CISA Bulletin). A community discussion was opened in the ProjectDiscovery nuclei-templates repository to develop detection templates for this CVE (Nuclei Templates Issue). Security aggregator sites and PoC tracking blogs such as tonyharris.io noted the availability of the Exploit-DB entry in early February 2026. No significant vendor statement from Hasura or broad mainstream media coverage has been identified at this time.