# Broken Object-Level Authorization (BOLA) in Airline GraphQL Booking API Exploited via Autonomous AI Red-Team Agent

> Wiz's autonomous AI red-team agent ("Red Agent") found a critical BOLA flaw in an unnamed airline's GraphQL booking API, gaining unauthenticated read/write access to passenger PII and booking data within 15 minutes by walking sequential integer booking IDs through an anonymous session token with zero backend authorization checks.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1217
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-wiz-red-agent-airline-bola-tl-2026-1217.webp?v=7ab94d1c (Threadlinqs threat intel: Wiz Red Agent Airline GraphQL BOLA: Detection & IOCs (TL-2026-1217) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1217
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20

## Description

Wiz publicly documented a case study in which its autonomous AI-powered penetration-testing system, Red Agent (built on Anthropic Claude Opus models), fully compromised the GraphQL booking API of a major, unnamed airline in 15 minutes with zero human guidance and zero credentials. The agent began by statically analyzing client-side JavaScript bundles to map the backend architecture, discovering an API gateway subdomain and a multi-step token-acquisition flow (`/api/kdf/v2/token` -> `/api/kdf/v1/token`). It minted a valid anonymous session token by replaying the token endpoint with empty credentials, then used GraphQL introspection against `POST /api/v1/graph` to enumerate the full schema: 514 queries and 428 mutations exposed to the anonymous role. Testing the `bookingRetrieveByBookingId` mutation against twenty sequential integer booking IDs returned twenty distinct customer profiles, confirming a textbook Broken Object-Level Authorization (OWASP API1:2023) condition: the frontend issued role-differentiated session tokens (anonymous/registered/corporate), but the backend GraphQL resolvers never validated caller identity/role against the requested object before returning data. Cross-referencing REST endpoints (`/api/kdf/v1/booking/passengers`, `/booking/contacts`, `/booking/payments`) validated the scope of exposure. The exposed dataset spanned two years of passenger records: full names, DOB, gender, email, direct phone numbers, billing addresses, masked card data (last 4 + expiry), loyalty numbers, and complete itineraries (origin/destination/departure times). Beyond read access, the anonymous session carried full write capability over active bookings via mutations including `contactsChange`/`bookingSet` (account hijacking by altering contact email), `flightDelete` (segment/trip cancellation), `groupDivide` (separating travelers from a group booking), `priceOverride` (zeroing out fares), and `refundIssue`/`voidRefund` (issuing unauthorized refunds to arbitrary accounts). Wiz notes this class of logic flaw is invisible to traditional DAST/signature-based scanners because every request uses syntactically valid GraphQL against legitimate endpoints with no anomalous traffic signature — detection requires semantic, role-vs-object authorization testing, which is precisely what an LLM-driven autonomous agent can perform at scale (Wiz cites Red Agent scanning 150,000+ production web apps/APIs weekly in public preview). No CVE is assigned since this is a vendor-specific, unnamed production target rather than a shipped product; the significance for defenders is the generalizable pattern — sequential/guessable object identifiers plus resolver-level authorization gaps in GraphQL APIs — and the demonstration that autonomous AI red-teaming can now find and weaponize this class of bug end-to-end without human operators.

## MITRE ATT&CK

- T1595 Active Scanning
- T1594 Search Victim-Owned Websites
- T1590 Gather Victim Network Information
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1074 Data Staged
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1531 Account Access Removal
- T1657 Financial Theft
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GraphQL Anonymous Token Replay Against Booking API — Exploitation** (`TL-2026-1217-SPL-001`)

Detects replay of the /api/kdf/v2/token or /api/kdf/v1/token issuance endpoints with empty/null credential bodies that still return HTTP 200, the initial exploitation step used to mint an unauthenticated anonymous session token against the airline GraphQL booking API (Wiz Red Agent BOLA case study).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606, T1528
- **Data sources:** api_gateway_access_logs, web_proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web_proxy sourcetype="api_gateway:access" (uri_path="/api/kdf/v2/token" OR uri_path="/api/kdf/v1/token") http_method=POST status=200
| eval creds_empty=if(len(request_body)<=2 OR match(request_body,"^\{\s*\}$"),1,0)
| where creds_empty=1
| bin _time span=5m
| stats count values(uri_path) as endpoints_hit dc(uri_path) as distinct_endpoints by src_ip, _time
| where count>=2 AND distinct_endpoints>=2
| sort -count
```

### Microsoft KQL

```kql
let lookback = 24h;
ApiGatewayLogs
| where TimeGenerated > ago(lookback)
| where UriPath in ("/api/kdf/v2/token", "/api/kdf/v1/token")
| where HttpMethod == "POST" and ResponseStatus == 200
| where RequestBodySize <= 2 or RequestBody matches regex @'^\{\s*\}$'
| summarize EndpointHits = count(), DistinctEndpoints = dcount(UriPath) by SourceIP, bin(TimeGenerated, 5m)
| where EndpointHits >= 2 and DistinctEndpoints >= 2
| project TimeGenerated, SourceIP, EndpointHits, DistinctEndpoints
| order by EndpointHits desc
```

### Sigma

```yaml
title: Anonymous Session Token Replay Against Booking API Token Endpoint
id: 8f1e6a2c-1217-4b7a-9c3d-token-replay-spl001
status: experimental
description: Detects empty-credential replay against a GraphQL API's token-issuance endpoints, the initial access step of an autonomous BOLA exploitation chain (Wiz Red Agent airline case study).
references:
    - https://www.wiz.io/blog/red-agent-pov-bola
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1606
    - attack.t1528
    - owasp.api1.2023
logsource:
    category: webserver
    product: api-gateway
detection:
    selection:
        cs-uri-path|contains:
            - '/api/kdf/v2/token'
            - '/api/kdf/v1/token'
        cs-method: 'POST'
        sc-status: 200
    filter_empty_creds:
        cs-bytes: 2
    condition: selection and filter_empty_creds
    timeframe: 5m
falsepositives:
    - Automated health-check probes against the token endpoint
    - QA/staging synthetic monitoring using empty-body requests
level: medium
```

**Known false positives:**

- Legitimate synthetic/uptime monitoring hitting the token endpoint with an intentionally empty body
- Client SDK retry logic resending a malformed empty-credential request

**Tuning notes:** Baseline normal empty-body volume from known monitoring/service-account source IPs and allowlist them; tighten the 5-minute window and count threshold per-environment traffic volume before enabling auto-block actions.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GraphQL Schema Introspection Followed by Novel Mutation Burst — Exploitation (locked: unlock with TL Creds)
- Object-ID Enumeration Yielding Distinct Actor-Owned Records — Post-Exploitation BOLA Confirmation (locked: unlock with TL Creds)
- Anonymous-Role Financial Mutation (priceOverride/refundIssue) Yielding Zero-Cost or Unbacked Refund — C2/Lateral-Financial-Impact (locked: unlock with TL Creds)
- [indicator] Recon Against Booking Frontend — Exploitation Precursor (locked: unlock with TL Creds)
- Valid-Accounts Style Session Escalation — Anonymous Token Used for Role-Restricted Mutations (locked: unlock with TL Creds)
- Destructive Booking/Flight-Segment Deletion at Volume — Data Destruction Impact (locked: unlock with TL Creds)
- GraphQL Write-Mutation Sweep From Anonymous Role — Post-Exploitation (locked: unlock with TL Creds)
- High-Volume Automated Exfiltration of Booking/PII Records via GraphQL — C2/Exfil (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API](https://www.wiz.io/blog/red-agent-pov-bola)
- [Introducing the Wiz Red Agent - AI-Powered Attacker](https://www.wiz.io/blog/introducing-the-wiz-red-agent)
- [Introducing Wiz Agents & Workflows for AI Security](https://www.wiz.io/blog/introducing-wiz-agents)
- [Wiz launches Red Agent for AI vulnerability simulation](https://www.scworld.com/brief/wiz-launches-red-agent-for-ai-vulnerability-simulation)
- [Red Agent and Claude Opus: Securing Production Targets at Scale](https://www.wiz.io/blog/red-agent-claude-opus)
- [Autonomous AI Agent Breaches Airline Booking Database in 15 Minutes](https://securitypointbreak.com/2026/06/30/wiz-autonomous-ai-agent-breaches-airline-booking-database-in-15-minutes/)
- [Introducing the Red Agent POV Series](https://www.wiz.io/blog/red-agent-pov-series)
- [API1:2023 Broken Object Level Authorization - OWASP API Security Top 10](https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/)
- [API3:2023 Broken Object Property Level Authorization - OWASP API Security Top 10](https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/)
- [OWASP Top 10 API Security Risks – 2023](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1217