CVE-2026-49462: NL Portal Backend Information Disclosure

CVE-2026-49462 Overview

CVE-2026-49462 affects NL Portal Backend Libraries, a set of backend components used by Dutch government portals to interact with residents, customers, suppliers, and partner organizations. Versions up to and including 3.0.0 ship with a default configuration that exposes two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Any unauthenticated caller who can reach the /graphiql endpoint can load the interactive query UI in a browser and download the full API schema. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Version 3.0.1 patches the default configuration.

Critical Impact
Unauthenticated attackers can enumerate every query, mutation, type, and argument in the GraphQL API, removing the guesswork from targeting downstream endpoints.

Affected Products

NL Portal Backend Libraries versions up to and including 3.0.0
Deployments using the shipped default configuration for GraphQL settings
Dutch government portal implementations built on top of these libraries

Discovery Timeline

2026-09-11 - CVE-2026-49462 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-49462

Vulnerability Analysis

The vulnerability sits in the default GraphQL configuration shipped with NL Portal Backend Libraries. Two developer-oriented features remain enabled and unauthenticated in production builds: the GraphiQL playground and GraphQL schema introspection. GraphiQL is an interactive web UI for issuing GraphQL queries. Schema introspection lets a caller retrieve a machine-readable description of every query, mutation, type, and argument the API supports.

On its own, this exposure does not directly leak user records. It provides attackers with a complete map of the API surface, including field names, argument types, and relationships between objects. That map removes reconnaissance friction and accelerates the discovery of downstream authorization flaws, injection paths, or business-logic weaknesses.

Root Cause

The root cause is an insecure default configuration. The shipped defaults enable GraphiQL and introspection without requiring authentication on the /graphiql endpoint. Operators who deploy the library without overriding these settings inherit the exposure. The maintainers addressed the issue in version 3.0.1 by changing the defaults, as documented in the GitHub Security Advisory GHSA-9m9w-2vqr-m384 and the remediation commit.

Attack Vector

Exploitation requires only network reachability to the portal. An attacker browses to /graphiql, loads the playground, and issues a standard GraphQL introspection query against the endpoint. The response contains the full schema, which the attacker uses to craft targeted queries and mutations against the rest of the API. No credentials, user interaction, or elevated privileges are required.

For technical implementation details of the fix, refer to the remediation commit on GitHub.

Detection Methods for CVE-2026-49462

Indicators of Compromise

HTTP GET requests to /graphiql from external or untrusted source addresses
POST requests to the GraphQL endpoint containing the __schema or __type introspection fields
Unusually broad or sequential GraphQL queries that enumerate types, fields, and arguments
User-Agent strings associated with GraphQL tooling such as graphql-cli, Insomnia, or Postman hitting production endpoints

Detection Strategies

Inspect web server and reverse-proxy access logs for successful 200 responses to /graphiql on internet-facing deployments
Alert on GraphQL request bodies that contain IntrospectionQuery or reference the __schema root field
Correlate schema-enumeration activity with subsequent unusual query patterns against sensitive types

Monitoring Recommendations

Route portal traffic through a web application firewall configured to block or log requests to /graphiql on production hosts
Baseline normal GraphQL query shapes and flag deviations that pull large numbers of distinct types in a short window
Track deployed versions of NL Portal Backend Libraries in your software inventory and alert on any instance still running 3.0.0 or earlier

How to Mitigate CVE-2026-49462

Immediate Actions Required

Upgrade NL Portal Backend Libraries to version 3.0.1 or later
Audit all portal deployments to confirm /graphiql is not reachable from untrusted networks
Review recent access logs for unauthenticated hits to /graphiql and introspection queries against the GraphQL endpoint
Rotate any secrets or tokens whose names or scopes may have been inferred from a leaked schema

Patch Information

The maintainers released version 3.0.1, which changes the default configuration so that GraphiQL and schema introspection are no longer exposed without authentication. Details are available in the GitHub Security Advisory GHSA-9m9w-2vqr-m384 and the associated fix commit.

Workarounds

Override the two GraphQL settings in deployed configuration to disable the GraphiQL playground and schema introspection
Enforce authentication or IP allow-listing on the /graphiql route through a reverse proxy or API gateway
Restrict the GraphQL endpoint to trusted internal networks where developer tooling is required

bash

# Configuration example - disable GraphiQL and introspection in deployed configuration
# Override defaults per the maintainer guidance in GHSA-9m9w-2vqr-m384
graphql:
  graphiql:
    enabled: false
  schema:
    introspection: false