CVE-2026-33286: 
Ruby vulnerability analysis and mitigation

CVE-2026-33286 is an arbitrary method execution vulnerability in Graphiti, a Ruby framework that exposes models via a JSON:API-compliant interface. The flaw affects all versions up to and including 1.10.1 (i.e., prior to 1.10.2) and was disclosed on March 20, 2026, via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 9.1 (Critical), reflecting its network-accessible, unauthenticated, no-user-interaction attack profile (GitHub Advisory, Graphiti Advisory).

The root cause is improper input validation combined with improper control of dynamically-managed code resources (CWE-913, CWE-20). Specifically, the Graphiti::Util::ValidationResponse#all_valid? method recursively calls model.send(name) using relationship names extracted directly from user-supplied JSONAPI payloads, without first validating those names against the resource's configured sideloads. An attacker can craft a malicious JSONAPI write request (POST/PATCH/DELETE) containing arbitrary relationship names that map to any public Ruby method on the model instance, its class, or associated objects — including destructive operations. The patch (commit ddb5ad2) adds a validation step in process_relationships that checks each relationship key against resource.class.sideload(name.to_sym) and rejects unknown relationships with an invalid_relationship error (Graphiti Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to invoke any public method on the underlying ActiveRecord (or compatible) model instance, its class, or associated instances — including destructive operations such as mass deletion or data corruption. The CVSS scoring reflects high integrity and high availability impact with no confidentiality impact, meaning attackers can modify or destroy backend data but direct data exfiltration via this vector is not the primary concern. Any Rails application exposing Graphiti write endpoints (create, update, or delete) to untrusted or unauthenticated users is at risk of complete data integrity loss and service disruption (GitHub Advisory, Graphiti Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker against exposed write endpoints. The EPSS score is approximately 0.039% (19th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report. Qualys has added detection for this vulnerability (Feedly).

1. Reconnaissance: Identify applications using the Graphiti gem (versions ≤ 1.10.1) by inspecting publicly accessible Gemfile.lock files, API response headers, or JSON:API-formatted endpoints that accept write operations (POST/PATCH/DELETE).
2. Identify write endpoints: Locate Graphiti-backed create or update API endpoints (e.g., POST /api/v1/employees or PATCH /api/v1/employees/:id) that accept JSON:API-formatted request bodies.
3. Craft malicious payload: Construct a JSONAPI payload where the relationships object contains an arbitrary key whose name corresponds to a destructive public method on the target model (e.g., destroy_all, delete_all, or a custom method). Example payload structure:

{
  "data": {
    "type": "employees",
    "attributes": {"first_name": "Jane"},
    "relationships": {
      "destroy_all": {
        "data": {"type": "employees", "id": "1", "method": "update"}
      }
    }
  }
}

4. Submit the request: Send the crafted payload to the write endpoint. The Graphiti::Util::ValidationResponse#all_valid? method will call model.send("destroy_all") (or the specified method name) without validation.
5. Achieve objective: The target public method executes on the model instance or class, potentially deleting records, corrupting data, or triggering other destructive operations on the backend database (Graphiti Advisory, Patch Commit).

• Network: Unexpected POST or PATCH requests to Graphiti write endpoints containing relationships keys that do not correspond to any configured sideloads (e.g., relationship names matching Ruby model methods like destroy, destroy_all, delete_all, update_all).
• Logs: Rails application logs showing model.send() calls with unusual method names; error traces originating from Graphiti::Util::ValidationResponse#all_valid? with unexpected relationship names; sudden mass record deletions or updates logged in the database audit trail.
• Application Behavior: Unexpected bulk data deletion or modification events in the database not correlated with legitimate user activity; application errors or exceptions triggered by invocation of non-relationship methods on model objects.

The primary remediation is to upgrade the Graphiti gem to version 1.10.2 or later, which validates relationship names against configured sideloads before processing (GitHub Advisory, v1.10.2 Release). If an immediate upgrade is not feasible, apply the following interim mitigations: (1) Restrict Graphiti write endpoints (create/update/delete) so they are accessible only to authenticated and authorized users; (2) Implement strong authentication and authorization checks before any write operation is processed; (3) Use Rails strong parameters to ensure only valid, expected parameters are accepted by the application.

The vulnerability was discovered by security researcher doublevoid and reported by simonrand, with the advisory published by Graphiti maintainer jkeen on March 20, 2026 (GitHub Advisory). Coverage appeared on The Hacker Wire and security aggregators including RubySec, Infinitsec, and CyberHub shortly after disclosure, reflecting moderate community interest. Social media discussion was observed on Mastodon and Bluesky, primarily from automated CVE tracking accounts rather than active researcher commentary.