Taskcluster web-server: Unauthenticated remote code execution via GraphQL filter
Summary
Taskcluster versions before 100.3.0 contain a flaw in the GraphQL endpoint of the web-server. The filter arguments are parsed with the sift library, which allows code execution. Deployments that expose an anonymous role can be attacked without authentication. The CVSS 4.0 score is 8.7 (High) because the vulnerability is network-accessible with low complexity and no privileges required.
Affected
- Taskcluster versions before 100.3.0
- Relevant only if the deployment has an anonymous role and a reachable GraphQL endpoint
Fixed in
- Taskcluster 100.3.0 (fix commits a1b0154 and fe314d9). Later releases exist; use the latest release.
Workaround
- Unknown. The vendor advisory does not describe a workaround; the upgrade is the remedy.
- Until patched: remove or disable the anonymous role and restrict network access to the GraphQL endpoint.
Exploitation
- No known exploitation in the wild (KEV status: not listed, per aggregator sources).
- No public proof of concept found.
- CISA SSVC: automatable yes, technical impact partial.
Our recommendation
- Check whether any self-hosted Taskcluster deployment exists.
- If one exists, upgrade to the latest release, not only 100.3.0.
- Confirm that no anonymous role is enabled and restrict the GraphQL endpoint to trusted networks.
- Review logs for unexpected GraphQL requests.
- Most SMEs do not run this software; no action is needed if no deployment exists.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-ccv5-c45x-2q38 github.com
- Taskcluster release v100.3.0 github.com
- Fix commit a1b0154 github.com
- Taskcluster issue 8716 github.com
- Taskcluster pull request 8718 github.com
- OSV entry CVE-2026-55094 osv.dev
- OpenCVE CVE-2026-55094 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:34.
Original description (NVD)
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library. This issue has been patched in version 100.3.0.
NVD references (6)
- https://bugzilla.mozilla.org/show_bug.cgi?id=2045091
- https://github.com/taskcluster/taskcluster/commit/a1b0154b8235937657c2ded127f193b564e2334b
- https://github.com/taskcluster/taskcluster/issues/8716
- https://github.com/taskcluster/taskcluster/pull/8718
- https://github.com/taskcluster/taskcluster/releases/tag/v100.3.0
- https://github.com/taskcluster/taskcluster/security/advisories/GHSA-ccv5-c45x-2q38
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.