GitHub Security Advisory: GHSA-h9mw-h4qc-f5jf
Package: github.com/platform-mesh/kubernetes-graphql-gateway (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 1.2.8
Patched in: 1.2.9

Summary: kubernetes-graphql-gateway: GraphQL Endpoint Vulnerable to Authenticated Denial-of-Service via Unrestricted Query Execution

Details:
**CVSS 6.5 Medium** — The GraphQL API served by kubernetes-graphql-gateway is vulnerable to Denial-of-Service (DoS) attacks due to a complete absence of query resource controls (depth limiting, complexity analysis, response size capping, and rate limiting). An authenticated attacker can craft queries that force the server to compute and serialize multi-megabyte responses, consuming significant CPU, memory, and network bandwidth. Repeated requests can exhaust server resources and degrade or deny service to legitimate users.

> **Note:** A previous version of this advisory (based on pre-v1 code) documented an unauthenticated attack surface via an HTTP GET method bypass in the former `registry.go`. That bypass has been removed in v1 — all requests now require a Bearer token. The CVSS score has been adjusted from 7.5 to 6.5 accordingly (Privileges Required: None → Low). CWE-306 (Missing Authentication for Critical Function) no longer applies.

## Root Cause

The kubernetes-graphql-gateway uses the `graphql-go/graphql` library (v0.8.1) with the `graphql-go/handler` HTTP handler. The handler is instantiated in `gateway/gateway/graphql/graphql.go` with only cosmetic configuration — no resource limits:

```go
// gateway/gateway/graphql/graphql.go — CreateHandler()
func (s *GraphQLServer) CreateHandler(schema *graphql.Schema) *GraphQLHandler {
    graphqlHandler := handler.New(&handler.Config{
        Schema:     schema,
        Pretty:     s.config.Pretty,
        Playground: s.config.Playground,
        GraphiQL:   s.config.GraphiQL,
    })
    return &GraphQLHandler{
        Schema:  schema,
        Handler: graphqlHandler,
    }
}
```

The `handler.Config` struct does not include `MaxDepth`, `MaxComplexity`, `MaxResponseSize`, or any equivalent fields. Neither the `graphql-go/handler` nor the underlying `graphql-go/graphql` library provides built-in query depth or complexity analysis.

The application configuration (`gateway/gateway/config/config.go`) has no fields for resource limits:

```go
// gateway/gateway/config/config.go — GraphQL config
type GraphQL struct {
    Pretty     bool
    Playground bool
    GraphiQL   bool
}
```

No rate limiting, throttling, or request size controls exist anywhere in the codebase.

## Authentication Model

All requests pass through the HTTP handler in `gateway/http/http.go`, which extracts a Bearer token and injects it into the request context:

```go
// gateway/http/http.go — Token extraction (applied to all methods)
s.Handle("/api/clusters/{clusterName}", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    clusterName := r.PathValue("clusterName")
    authHeader := r.Header.Get("Authorization")
    token := strings.TrimPrefix(authHeader, "Bearer ")
    ctx := utilscontext.SetToken(r.Context(), token)
    ctx = utilscontext.SetCluster(ctx, clusterName)
    c.Gateway.ServeHTTP(w, r.WithContext(ctx))
}))
```

The token is enforced at the Kubernetes API layer via `gateway/gateway/roundtripper/bearer.g