Submit finding

All findings

github-taskflow-graphql-ruby-authorization-bypass high

Taskflow finds a graphql-ruby authorization bypass

A project GHSA and GitHub Security Lab advisory directly credit the Taskflow Agent on a high-severity authorization bypass in graphql-ruby's Execution::Next path.

Bug class
Authorization bypass in alternate GraphQL execution path
Affected codebase
graphql-ruby Execution::Next, fixed in 2.6.6
Credited system
GitHub Security Lab Taskflow Agent
Latest disclosure
August 8, 2026
Coverage
Project advisory July 21; GHSL write-up August 8, 2026
Attribution
Direct source attribution
AI role
Discovery
Severity
high
Source status: The graphql-ruby GHSA explicitly credits Taskflow Agent and manual verification. The issue is fixed in 2.6.6 and had no CVE at the cutoff.

Summary

The flaw lets requests using graphql-ruby’s Execution::Next path bypass authorization checks in affected configurations. Version 2.6.6 contains the fix. The finding is high severity but has no CVE, so it adds one accepted finding page and zero unique identifiers.

The project advisory names the Taskflow Agent and says a GitHub Security Lab researcher manually verified the result. This is direct discovery credit with a human-validation boundary.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.