github.com/dgraph-io/dgraph/v25
high-performance graph database for real-time use cases
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 35
- Cadence
- ~9 days
- Last 12 months
- 19
Reach
- Stars
- 21.8k
Details
- First release
- Apr 18, 2025
| Version | Released | |
|---|---|---|
v25.4.1
patch
|
v25.4.1
patch
Dependencies (68)
+ 60 more |
|
v25.4.0
minor
|
v25.4.0
minor
Dependencies (68)
+ 60 more |
|
v25.3.8
patch
|
v25.3.8
patch
Dependencies (68)
+ 60 more |
|
v25.3.8-preview1
pre
|
v25.3.8-preview1
pre
Dependencies (68)
+ 60 more |
|
v25.3.7
patch
|
v25.3.7
patch
Dependencies (68)
+ 60 more |
|
v25.3.6
patch
|
v25.3.6
patch
Dependencies (68)
+ 60 more |
|
v25.3.5
patch
|
v25.3.5
patch
Dependencies (68)
+ 60 more |
|
v25.4.0-preview1
pre
|
v25.4.0-preview1
pre
Dependencies (68)
+ 60 more |
|
v25.3.4
patch
1 CVE
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev |
v25.3.4
patch
Dependencies (68)
+ 60 more |
|
v25.3.3
patch
2 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.3
patch
Dependencies (67)
+ 59 more |
|
v25.3.2
patch
5 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.2
patch
Dependencies (67)
+ 59 more |
|
v25.3.1
patch
6 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.1
patch
Dependencies (67)
+ 59 more |
|
v25.3.1-preview-federation-changes
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.1-preview-federation-changes
pre
Dependencies (67)
+ 59 more |
|
v25.3.0
minor
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.0
minor
Dependencies (67)
+ 59 more |
|
v25.3.0-preview-no-maxprocs
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.3.0-preview-no-maxprocs
pre
Dependencies (67)
+ 59 more |
|
v25.2.0
minor
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.2.0
minor
Dependencies (67)
+ 59 more |
|
v25.1.0
minor
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.1.0
minor
Dependencies (67)
+ 59 more |
|
v25.1.0-preview1
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.1.0-preview1
pre
Dependencies (67)
+ 59 more |
|
v25.0.0
initial
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0
initial
Dependencies (67)
+ 59 more |
|
v25.0.0-shingles5
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-shingles5
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-shingles4
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-shingles4
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-shingles3
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-shingles3
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-shingles2
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-shingles2
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-shingles
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-shingles
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-split-vector3
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-split-vector3
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-split-vector2
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-split-vector2
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-split-vector
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-split-vector
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-preview6
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview6
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-preview5
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview5
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-custom-qt-improv-2
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-custom-qt-improv-2
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-custom-qt-improv-1
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-custom-qt-improv-1
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-preview4
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview4
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-preview3
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview3
pre
Dependencies (67)
+ 59 more |
|
v25.0.0-preview2
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview2
pre
Dependencies (66)
+ 58 more |
|
v25.0.0-preview1
pre
7 CVEs
CVE-2026-54061
GO-2026-6261
GHSA-rrwh-6jrq-wp5v
Aug 25, 2026
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data. Fixed in
25.3.5
References Updated Aug 26, 2026 · Source: OSV.dev
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.2
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
25.3.3
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
25.3.1
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
25.3.3
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Fixed in
25.3.4
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
25.3.3
Updated Jul 23, 2026 · Source: OSV.dev |
v25.0.0-preview1
pre
Dependencies (66)
+ 58 more |