Wiz describes a third intrusion in which a GraphQL endpoint exposed MCP command and argument parameters that later reached Python subprocess creation. The significant failure was the missing authorization boundary between an API caller selecting tool arguments and a backend process executing them with host authority. Wiz recovered more than 150 scripts…
Inspect the ClaimsCase · DiggingBeagle record
GraphQL-exposed MCP arguments became Python subprocess authority
In a third Wiz investigation, attacker-controlled MCP command arguments flowed into subprocess execution inside a backend service.
Scope
A distinct Wiz-observed GraphQL/MCP backend path with command-subprocess execution. Extent of downstream victims, data leakage and exact model attribution remains bounded by available artifacts.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI / WITH AI
Basis and provenance
Wiz documented execution effects and more than 150 scripts. Broad claimed victim or data-loss figures are not independently corroborated. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-WIZ-GRAPHQL-MCP-RCE-1 · Wiz: three observed adaptive intrusion investigations
At a glance
A target inventory or an attacker assertion of 600,000 records cannot substitute for proven egress or compromise evidence.
Read the implicationsThe claimed six-figure data-row theft volume was not independently validated. The set of affected third-party financial services remains unconfirmed.
Limits and uncertaintyFull account
Wiz describes a third intrusion in which a GraphQL endpoint exposed MCP command and argument parameters that later reached Python subprocess creation. The significant failure was the missing authorization boundary between an API caller selecting tool arguments and a backend process executing them with host authority. Wiz recovered more than 150 scripts during a roughly twenty-one-hour period and reported root-shell, pod persistence and cloud credential attempts. These observations are not interchangeable with the separate Flowise and Java gateway intrusions.
The investigators also found a list of financial-technology targets. A target list is not a confirmed victim list, and attacker commentary about hundreds of thousands of rows does not establish data theft. The case should be evaluated against actual process traces, pod changes and verified egress rather than general claims about agentic attack volume.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-WIZ-GRAPHQL-MCP-RCE-1Wiz reported GraphQL MCP command arguments reaching Python subprocess execution and observed host-level effects, but did not verify all named third-party targets as compromised.supported
Basis: reported finding
- supportsWiz: three observed adaptive intrusion investigationsprimary disclosure
Wiz report, GraphQL MCP backend mcpCommand/mcpArgs subprocess path and observed host effects
Implications
A target inventory or an attacker assertion of 600,000 records cannot substitute for proven egress or compromise evidence.
Controls and mitigations
- Prevent request-controlled subprocess invocation, bind tools to authenticated roles, isolate pods and verify secret access against actual egress logs.
Unknowns and contradictions
- The claimed six-figure data-row theft volume was not independently validated.
- The set of affected third-party financial services remains unconfirmed.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208