CVE-2026-10584: HTTPS Fallback to HTTP in Graph Explorer

Synopsis

This is an insecure transport fallback vulnerability in AWS Graph Explorer. When certificate files are missing from the proxy server configuration, the proxy silently downgrades connections from HTTPS to unencrypted HTTP, making traffic readable to anyone positioned between the client and the server. A remote attacker who can intercept that traffic reads the full content of requests and responses, including sensitive data such as credentials or query results. A patched-image rebuild at version 3.0.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on a network path between the client and the Graph Explorer proxy in order to intercept the downgraded HTTP traffic.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to observe the unencrypted traffic on the network path.

• Victim interactionNot required

  No user action is required; the proxy silently falls back to HTTP on its own when certificate files are absent.

• Attack complexityDetail

  While the base exploit is condition-free once HTTP fallback is active, the CVSS vector includes an attack requirement (AT:P) noting that a specific precondition, missing certificate files on the proxy, must already be present in the target environment.

Blast Radius

• The attacker reads the full plaintext content of HTTP requests that were intended to be encrypted, exposing any credentials, tokens, or API keys transmitted by the client.
• Graph query payloads and their responses are visible in transit, potentially disclosing sensitive data about the graph structure, node relationships, and stored records.
• Session or authorization headers passed to the Graph Explorer proxy are readable, which may allow the attacker to replay those headers against the backend API.