1. Support Center
  2. Issue Definitions
  3. GraphQL introspection enabled

GraphQL introspection enabled

Description: GraphQL introspection enabled

Introspection uses built-in queries to return information on a GraphQL schema itself. Like regular GraphQL queries, introspection queries are highly customizable, enabling users to specify the content and data shape of the response.

GraphQL introspection can represent a significant security risk when enabled in production, as it enables attackers to see what operations are available to them within the API, as well as other potentially sensitive information such as type descriptions and private fields.

Remediation: GraphQL introspection enabled

Ensure that you have disabled introspection on your GraphQL server. Consult your server documentation if you are unsure how to do this.


Vulnerability classifications

Typical severity


Type index (hex)


Type index (decimal)


Burp Scanner

This issue - and many more like it - can be found using our web vulnerability scanner

Read more

Get Burp

Scan your web application from just $449.00

Find out more