Broken Object-Level Authorization (BOLA) in Airline GraphQL Booking API Exploited via Autonomous AI Red-Team Agent

Broken Object-Level Authorization (BOLA) in Airline GraphQL (TL-2026-1217), also tracked as Red Agent POV: Airline GraphQL BOLA, is a critical-severity software vulnerability, first published 2026-07-11. It has no confirmed attribution, affects Unnamed airline (Wiz customer/target, not disclosed) GraphQL booking, maps to 19 MITRE ATT&CK techniques (T1046, T1059, T1074), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1217

Threat ID
TL-2026-1217
Also known as
Red Agent POV: Airline GraphQL BOLA
Severity
CRITICAL
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
aviation, travel, transport, hospitality
Target regions
Global
Detection rules
9
Indicators of compromise
20

Malware and tooling in Broken Object-Level Authorization (BOLA) in Airline GraphQL

Malware and tooling: Anthropic Claude Opus, Wiz Red Agent

Wiz's autonomous AI red-team agent ("Red Agent") found a critical BOLA flaw in an unnamed airline's GraphQL booking API, gaining unauthenticated read/write access to passenger PII and booking data within 15 minutes by walking sequential integer booking IDs through an anonymous session token with zero backend authorization checks.

How Broken Object-Level Authorization (BOLA) in Airline GraphQL works

Wiz publicly documented a case study in which its autonomous AI-powered penetration-testing system, Red Agent (built on Anthropic Claude Opus models), fully compromised the GraphQL booking API of a major, unnamed airline in 15 minutes with zero human guidance and zero credentials. The agent began by statically analyzing client-side JavaScript bundles to map the backend architecture, discovering an API gateway subdomain and a multi-step token-acquisition flow (`/api/kdf/v2/token` -> `/api/kdf/v1/token`). It minted a valid anonymous session token by replaying the token endpoint with empty credentials, then used GraphQL introspection against `POST /api/v1/graph` to enumerate the full schema: 514 queries and 428 mutations exposed to the anonymous role. Testing the `bookingRetrieveByBookingId` mutation against twenty sequential integer booking IDs returned twenty distinct customer profiles, confirming a textbook Broken Object-Level Authorization (OWASP API1:2023) condition: the frontend issued role-differentiated session tokens (anonymous/registered/corporate), but the backend GraphQL resolvers never validated caller identity/role against the requested object before returning data. Cross-referencing REST endpoints (`/api/kdf/v1/booking/passengers`, `/booking/contacts`, `/booking/payments`) validated the scope of exposure. The exposed dataset spanned two years of passenger records: full names, DOB, gender, email, direct phone numbers, billing addresses, masked card data (last 4 + expiry), loyalty numbers, and complete itineraries (origin/destination/departure times). Beyond read access, the anonymous session carried full write capability over active bookings via mutations including `contactsChange`/`bookingSet` (account hijacking by altering contact email), `flightDelete` (segment/trip cancellation), `groupDivide` (separating travelers from a group booking), `priceOverride` (zeroing out fares), and `refundIssue`/`voidRefund` (issuing unauthorized refunds to arbitrary accounts). Wiz notes this class of logic flaw is invisible to traditional DAST/signature-based scanners because every request uses syntactically valid GraphQL against legitimate endpoints with no anomalous traffic signature — detection requires semantic, role-vs-object authorization testing, which is precisely what an LLM-driven autonomous agent can perform at scale (Wiz cites Red Agent scanning 150,000+ production web apps/APIs weekly in public preview). No CVE is assigned since this is a vendor-specific, unnamed production target rather than a shipped product; the significance for defenders is the generalizable pattern — sequential/guessable object identifiers plus resolver-level authorization gaps in GraphQL APIs — and the demonstration that autonomous AI red-teaming can now find and weaponize this class of bug end-to-end without human operators.

MITRE ATT&CK techniques used in TL-2026-1217

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter

Collection

T1074 Data Staged; T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Impact

T1485 Data Destruction; T1531 Account Access Removal; T1565 Data Manipulation; T1657 Financial Theft

Credential Access

T1528 Steal Application Access Token; T1606 Forge Web Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1594 Search Victim-Owned Websites; T1595 Active Scanning

Affected products and versions in Broken Object-Level Authorization (BOLA) in Airline GraphQL

  • Unnamed airline (Wiz customer/target, not disclosed) — GraphQL booking API (public web/mobile booking platform)
    Vulnerable versions: production as of 2026-06-29 disclosure
    Fixed in: not disclosed / vendor unnamed

Remediation for Broken Object-Level Authorization (BOLA) in Airline GraphQL

Immediate actions

  • Add object-level authorization checks to every GraphQL resolver that accepts a client-supplied identifier (bookingId, contactId, etc.) before returning or mutating data
  • Disable or restrict GraphQL schema introspection in production environments
  • Audit all mutations reachable by the anonymous/unauthenticated session role and remove write access to booking, contact, and payment objects
  • Rate-limit and anomaly-detect sequential ID enumeration against booking/session endpoints
  • Rotate/invalidate the zero-credential anonymous token issuance flow (/api/kdf/v2/token, /api/kdf/v1/token) if it grants broader scope than intended

Workarounds

  • Temporarily disable anonymous-role access to booking-retrieval and booking-mutation resolvers until per-object authorization is enforced

Longer-term hardening

  • Replace sequential integer booking identifiers with non-guessable, high-entropy identifiers (UUIDv4 or signed opaque tokens)
  • Enforce centralized, resolver-level RBAC/ABAC middleware so authorization is validated on every field resolution, not just at the API gateway
  • Adopt continuous automated API authorization testing (BOLA/BFLA fuzzing) as part of CI/CD, since traditional DAST does not catch object-level logic flaws
  • Implement field-level PII minimization in GraphQL responses to reduce blast radius of any future authorization gap
  • Establish API inventory and shadow-API discovery to ensure all 514 queries / 428 mutations are known, reviewed, and scoped to appropriate roles

Weaknesses (CWE) in Broken Object-Level Authorization (BOLA) in Airline GraphQL

CWE-639, CWE-284, CWE-863, CWE-862

Timeline of Broken Object-Level Authorization (BOLA) in Airline GraphQL

  • Wiz publicly announces the Red Agent, an autonomous AI-powered attacker built on Anthropic Claude Opus models, in Public Preview as part of Wiz Attack Surface Management (ASM).
  • Wiz discloses Red Agent is scanning 150,000+ production web applications and APIs weekly across design-partner and public-preview deployments.
  • Wiz publishes "The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API" as the inaugural post in its Red Agent POV series, describing the case study without naming the affected airline.
  • Full compromise achieved 15 minutes after start, with zero credentials and zero human guidance.
  • Agent cross-references REST endpoints (/booking/passengers, /booking/contacts, /booking/payments) to validate exposure scope, confirming two years of passenger PII and payment metadata accessible, plus write access via mutation abuse (account hijack, flight deletion, group separation, price override, fraudulent refunds).
  • Agent tests the bookingRetrieveByBookingId mutation against twenty sequential integer booking IDs; every request returns a distinct customer profile, confirming unauthenticated BOLA.
  • Agent performs GraphQL introspection against POST /api/v1/graph, mapping the full schema: 514 queries and 428 mutations reachable by the anonymous role.
  • Agent mints a valid anonymous session token by replaying the /api/kdf/v2/token and /api/kdf/v1/token endpoints with empty credentials.
  • Red Agent statically analyzes the airline's client-side JavaScript bundles, maps backend architecture, and discovers the API gateway subdomain and multi-step token-acquisition flow.
  • Security media (SecurityPointBreak and others) republish and analyze the disclosure, framing it as a milestone demonstration of autonomous AI offensive capability against production infrastructure.

Sources cited for Broken Object-Level Authorization (BOLA) in Airline GraphQL

Threats related to Broken Object-Level Authorization (BOLA) in Airline GraphQL

Detection coverage for TL-2026-1217

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1217 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats