{"id":"CVE-2026-117184","kind":"vulnerability","aliases":["CVE-2026-117184"],"related":[],"title":"Traggo server: crafted GraphQL POST request causes denial of service","description":"An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint","summary":"Traggo server v0.8.3 has a flaw in its GraphQL endpoint. A crafted POST request to that endpoint lets an attacker cause a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","package","self-hosted","traggo"],"not_affected_if":["no-network-exposure","other-versions"],"how_to_check":"- Run `traggo --version` or check the deployed image tag to see if the server is `0.8.3`.\n- Confirm whether the GraphQL endpoint is reachable from untrusted networks.","fix":null,"status":"open","published_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","triaged_at":"2026-10-30T16:32:33+00:00","updated_at":"2026-10-30T16:32:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T16:32:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Traggo server: crafted GraphQL POST request causes denial of service","impact":"low","summary":"Traggo server v0.8.3 has a flaw in its GraphQL endpoint. A crafted POST request to that endpoint lets an attacker cause a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["traggo","self-hosted","graphql"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server becomes unavailable to legitimate users until restarted","analyst_note":"Check the NVD entry and the traggo project repository for the exact trigger, auth requirement and a fixed version.","how_to_check":"- Run `traggo --version` or check the deployed image tag to see if the server is `0.8.3`.\n- Confirm whether the GraphQL endpoint is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-network-exposure"],"who_is_affected":"Teams running a self-hosted Traggo server at version 0.8.3 that expose its GraphQL endpoint to a network an attacker can reach. The sources do not say whether other versions are affected or whether authentication blocks the request.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000652,"input_tokens":4094,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117184':13A,16A '-2026':12A,15A 'allow':58C 'attack':42B,59C 'caus':7A,43B,61C 'craft':3A,34B,69C 'cve':11A,14A 'denial':8A,45B,63C 'dos':66C 'endpoint':32B,39B,53C,75C 'flaw':28B 'graphql':4A,17B,31B,52C,74C 'host':21B 'issu':49C 'let':40B 'packag':18B 'post':5A,35B,70C 'request':6A,36B,71C 'self':20B 'self-host':19B 'server':2A,24B,56C 'servic':10A,47B,65C 'traggo':1A,22B,23B,55C 'v0.8.3':25B,57C 'via':67C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Traggo server at version 0.8.3 that expose its GraphQL endpoint to a network an attacker can reach. The sources do not say whether other versions are affected or whether authentication blocks the request.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117184","severity":null,"published_at":"2026-10-30T16:17:41+00:00","modified_at":"2026-10-30T16:17:41+00:00","first_seen_at":"2026-10-30T16:31:25+00:00","fetched_at":"2026-10-30T16:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}