Skip to navigation

Threat reportVulnerabilityTL-2026-1217

Broken Object-Level Authorization (BOLA) in Airline GraphQL Booking API Exploited via Autonomous AI Red-Team Agent

criticalACTIVE

Wiz's autonomous AI red-team agent ("Red Agent") found a critical BOLA flaw in an unnamed airline's GraphQL booking API, gaining unauthenticated read/write access to passenger PII and booking data within 15 minutes by walking sequential integer booking IDs through an anonymous session token with zero backend authorization checks.

Key facts for Wiz Red Agent airline BOLA

IdentifiersTL-2026-1217
Also known asRed Agent POV: Airline GraphQL BOLA
SeverityCRITICAL
Exploitation statusExploited in the wild
Affected productsUnnamed airline (Wiz customer/target, not disclosed) GraphQL booking API (public web/mobile booking platform)
Weaknesses (CWE)CWE-639, CWE-284, CWE-863, CWE-862
ToolsAnthropic Claude Opus, Wiz Red Agent
MITRE ATT&CK techniquesT1046 Network Service Discovery, T1059 Command and Scripting Interpreter, T1074 Data Staged, T1078 Valid Accounts, T1119 Automated Collection, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1485 Data Destruction, T1518 Software Discovery, T1528 Steal Application Access Token, T1531 Account Access Removal, T1565 Data Manipulation and 7 more in the attack flow
MotivationUNKNOWN
Target sectorsaviation, travel, transport, hospitality
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Wiz Red Agent airline BOLA

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1217 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GraphQL Anonymous Token Replay Against Booking API — Exploitation

Detects replay of the /api/kdf/v2/token or /api/kdf/v1/token issuance endpoints with empty/null credential bodies that still return HTTP 200, the initial exploitation step used to mint an unauthenticated anonymous session token against the airline GraphQL booking API (Wiz Red Agent BOLA case study).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1606, T1528
  • Data sources: api_gateway_access_logs, web_proxy
  • Severity: high
  • Confidence: high

Splunk SPL

index=web_proxy sourcetype="api_gateway:access" (uri_path="/api/kdf/v2/token" OR uri_path="/api/kdf/v1/token") http_method=POST status=200
| eval creds_empty=if(len(request_body)<=2 OR match(request_body,"^\{\s*\}$"),1,0)
| where creds_empty=1
| bin _time span=5m
| stats count values(uri_path) as endpoints_hit dc(uri_path) as distinct_endpoints by src_ip, _time
| where count>=2 AND distinct_endpoints>=2
| sort -count

Microsoft KQL

let lookback = 24h;
ApiGatewayLogs
| where TimeGenerated > ago(lookback)
| where UriPath in ("/api/kdf/v2/token", "/api/kdf/v1/token")
| where HttpMethod == "POST" and ResponseStatus == 200
| where RequestBodySize <= 2 or RequestBody matches regex @'^\{\s*\}$'
| summarize EndpointHits = count(), DistinctEndpoints = dcount(UriPath) by SourceIP, bin(TimeGenerated, 5m)
| where EndpointHits >= 2 and DistinctEndpoints >= 2
| project TimeGenerated, SourceIP, EndpointHits, DistinctEndpoints
| order by EndpointHits desc

Sigma

title: Anonymous Session Token Replay Against Booking API Token Endpoint
id: 8f1e6a2c-1217-4b7a-9c3d-token-replay-spl001
status: experimental
description: Detects empty-credential replay against a GraphQL API's token-issuance endpoints, the initial access step of an autonomous BOLA exploitation chain (Wiz Red Agent airline case study).
references:
    - https://www.wiz.io/blog/red-agent-pov-bola
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - attack.t1528
    - owasp.api1.2023
logsource:
    category: webserver
    product: api-gateway
detection:
    selection:
        cs-uri-path|contains:
            - '/api/kdf/v2/token'
            - '/api/kdf/v1/token'
        cs-method: 'POST'
        sc-status: 200
    filter_empty_creds:
        cs-bytes: 2
    condition: selection and filter_empty_creds
    timeframe: 5m
falsepositives:
    - Automated health-check probes against the token endpoint
    - QA/staging synthetic monitoring using empty-body requests
level: medium

Known false positives:

  • Legitimate synthetic/uptime monitoring hitting the token endpoint with an intentionally empty body
  • Client SDK retry logic resending a malformed empty-credential request

Tuning notes: Baseline normal empty-body volume from known monitoring/service-account source IPs and allowlist them; tighten the 5-minute window and count threshold per-environment traffic volume before enabling auto-block actions.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • GraphQL Schema Introspection Followed by Novel Mutation Burst — Exploitation · unlock with TL Creds
  • Object-ID Enumeration Yielding Distinct Actor-Owned Records — Post-Exploitation BOLA Confirmation · unlock with TL Creds
  • Anonymous-Role Financial Mutation (priceOverride/refundIssue) Yielding Zero-Cost or Unbacked Refund — C2/Lateral-Financial-Impact · unlock with TL Creds
  • [indicator] Recon Against Booking Frontend — Exploitation Precursor · unlock with TL Creds
  • Valid-Accounts Style Session Escalation — Anonymous Token Used for Role-Restricted Mutations · unlock with TL Creds
  • Destructive Booking/Flight-Segment Deletion at Volume — Data Destruction Impact · unlock with TL Creds
  • GraphQL Write-Mutation Sweep From Anonymous Role — Post-Exploitation · unlock with TL Creds
  • High-Volume Automated Exfiltration of Booking/PII Records via GraphQL — C2/Exfil · unlock with TL Creds

Indicators of compromise for Wiz Red Agent airline BOLA

As of 2026-07-11, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1217.

20 indicators of compromise · unlock with TL Creds. Compare plans

How Wiz Red Agent airline BOLA works

Wiz publicly documented a case study in which its autonomous AI-powered penetration-testing system, Red Agent (built on Anthropic Claude Opus models), fully compromised the GraphQL booking API of a major, unnamed airline in 15 minutes with zero human guidance and zero credentials. The agent began by statically analyzing client-side JavaScript bundles to map the backend architecture, discovering an API gateway subdomain and a multi-step token-acquisition flow (`/api/kdf/v2/token` -> `/api/kdf/v1/token`). It minted a valid anonymous session token by replaying the token endpoint with empty credentials, then used GraphQL introspection against `POST /api/v1/graph` to enumerate the full schema: 514 queries and 428 mutations exposed to the anonymous role. Testing the `bookingRetrieveByBookingId` mutation against twenty sequential integer booking IDs returned twenty distinct customer profiles, confirming a textbook Broken Object-Level Authorization (OWASP API1:2023) condition: the frontend issued role-differentiated session tokens (anonymous/registered/corporate), but the backend GraphQL resolvers never validated caller identity/role against the requested object before returning data. Cross-referencing REST endpoints (`/api/kdf/v1/booking/passengers`, `/booking/contacts`, `/booking/payments`) validated the scope of exposure. The exposed dataset spanned two years of passenger records: full names, DOB, gender, email, direct phone numbers, billing addresses, masked card data (last 4 + expiry), loyalty numbers, and complete itineraries (origin/destination/departure times). Beyond read access, the anonymous session carried full write capability over active bookings via mutations including `contactsChange`/`bookingSet` (account hijacking by altering contact email), `flightDelete` (segment/trip cancellation), `groupDivide` (separating travelers from a group booking), `priceOverride` (zeroing out fares), and `refundIssue`/`voidRefund` (issuing unauthorized refunds to arbitrary accounts). Wiz notes this class of logic flaw is invisible to traditional DAST/signature-based scanners because every request uses syntactically valid GraphQL against legitimate endpoints with no anomalous traffic signature — detection requires semantic, role-vs-object authorization testing, which is precisely what an LLM-driven autonomous agent can perform at scale (Wiz cites Red Agent scanning 150,000+ production web apps/APIs weekly in public preview). No CVE is assigned since this is a vendor-specific, unnamed production target rather than a shipped product; the significance for defenders is the generalizable pattern — sequential/guessable object identifiers plus resolver-level authorization gaps in GraphQL APIs — and the demonstration that autonomous AI red-teaming can now find and weaponize this class of bug end-to-end without human operators.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter

Collection

T1074 Data Staged; T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Impact

T1485 Data Destruction; T1531 Account Access Removal; T1565 Data Manipulation; T1657 Financial Theft

Credential Access

T1528 Steal Application Access Token; T1606 Forge Web Credentials

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1594 Search Victim-Owned Websites; T1595 Active Scanning

Remediation for Wiz Red Agent airline BOLA

Immediate actions

  • Add object-level authorization checks to every GraphQL resolver that accepts a client-supplied identifier (bookingId, contactId, etc.) before returning or mutating data
  • Disable or restrict GraphQL schema introspection in production environments
  • Audit all mutations reachable by the anonymous/unauthenticated session role and remove write access to booking, contact, and payment objects
  • Rate-limit and anomaly-detect sequential ID enumeration against booking/session endpoints
  • Rotate/invalidate the zero-credential anonymous token issuance flow (/api/kdf/v2/token, /api/kdf/v1/token) if it grants broader scope than intended

Workarounds

  • Temporarily disable anonymous-role access to booking-retrieval and booking-mutation resolvers until per-object authorization is enforced

Longer-term hardening

  • Replace sequential integer booking identifiers with non-guessable, high-entropy identifiers (UUIDv4 or signed opaque tokens)
  • Enforce centralized, resolver-level RBAC/ABAC middleware so authorization is validated on every field resolution, not just at the API gateway
  • Adopt continuous automated API authorization testing (BOLA/BFLA fuzzing) as part of CI/CD, since traditional DAST does not catch object-level logic flaws
  • Implement field-level PII minimization in GraphQL responses to reduce blast radius of any future authorization gap
  • Establish API inventory and shadow-API discovery to ensure all 514 queries / 428 mutations are known, reviewed, and scoped to appropriate roles

Affected and fixed versions

  • Unnamed airline (Wiz customer/target, not disclosed) — GraphQL booking API (public web/mobile booking platform)
    Vulnerable versions: production as of 2026-06-29 disclosure
    Fixed in: not disclosed / vendor unnamed

Timeline of Wiz Red Agent airline BOLA

  • Wiz publicly announces the Red Agent, an autonomous AI-powered attacker built on locked-ioc-14 models, in Public Preview as part of Wiz Attack Surface Management (ASM).
  • Wiz discloses Red Agent is scanning 150,000+ production web applications and APIs weekly across design-partner and public-preview deployments.
  • Wiz publishes "The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API" as the inaugural post in its Red Agent POV series, describing the case study without naming the affected airline.
  • Full compromise achieved 15 minutes after start, with zero credentials and zero human guidance.
  • Agent cross-references REST endpoints (/booking/passengers, /booking/contacts, /booking/payments) to validate exposure scope, confirming two years of passenger PII and payment metadata accessible, plus write access via mutation abuse (account hijack, flight deletion, group separation, price override, fraudulent refunds).
  • Agent tests the bookingRetrieveByBookingId mutation against twenty sequential integer booking IDs; every request returns a distinct customer profile, confirming unauthenticated BOLA.
  • Agent performs GraphQL introspection against locked-ioc-16, mapping the full schema: 514 queries and 428 mutations reachable by the anonymous role.
  • Agent mints a valid anonymous session token by replaying the locked-ioc-17 and locked-ioc-18 endpoints with empty credentials.
  • Red Agent statically analyzes the airline's client-side JavaScript bundles, maps backend architecture, and discovers the API gateway subdomain and multi-step token-acquisition flow.
  • Security media (SecurityPointBreak and others) republish and analyze the disclosure, framing it as a milestone demonstration of autonomous AI offensive capability against production infrastructure.

Sources cited for Wiz Red Agent airline BOLA

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats