github.com/hypermodeinc/dgraph/v24
high-performance graph database for real-time use cases
View on Github
Activity
- Latest release
- 4mo ago
- Total releases
- 20
- Cadence
- ~11 days
- Last 12 months
- 4
Reach
- Stars
- 21.8k
Details
- First release
- Nov 16, 2024
| Version | Released | |
|---|---|---|
v24.1.9
patch
1 CVE
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.9
patch
Dependencies (60)
+ 52 more |
|
v24.1.8
patch
4 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.8
patch
Dependencies (60)
+ 52 more |
|
v24.1.7
patch
5 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.7
patch
Dependencies (60)
+ 52 more |
|
v24.1.6
patch
5 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.6
patch
Dependencies (60)
+ 52 more |
|
v24.1.5
patch
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.5
patch
Dependencies (60)
+ 52 more |
|
v24.1.4
patch
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.4
patch
Dependencies (60)
+ 52 more |
|
v24.1.4-test1
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.4-test1
pre
Dependencies (60)
+ 52 more |
|
v24.1.3
patch
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.3
patch
Dependencies (60)
+ 52 more |
|
v24.1.2
patch
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.2
patch
Dependencies (60)
+ 52 more |
|
v24.1.1
patch
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.1
patch
Dependencies (60)
+ 52 more |
|
v24.1.1-test2
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.1-test2
pre
Dependencies (60)
+ 52 more |
|
v24.1.1-test1
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.1-test1
pre
Dependencies (62)
+ 54 more |
|
v24.1.0
initial
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.0
initial
Dependencies (62)
+ 54 more |
|
v24.1.0-rc6
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.0-rc6
pre
Dependencies (62)
+ 54 more |
|
v24.0.6-test1
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.0.6-test1
pre
Dependencies (63)
+ 55 more |
|
v24.1.0-rc5
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.0-rc5
pre
Dependencies (62)
+ 54 more |
|
v24.1.0-rc4
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.1.0-rc4
pre
Dependencies (63)
+ 55 more |
|
v24.0.6-alpha3
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.0.6-alpha3
pre
Dependencies (64)
+ 56 more |
|
v24.0.6-alpha2
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.0.6-alpha2
pre
Dependencies (64)
+ 56 more |
|
v24.0.6-alpha1
pre
6 CVEs
CVE-2026-40173
GO-2026-5274
GHSA-95mq-xwj4-r47p
Aug 11, 2026
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-34976
GO-2026-5529
GHSA-p5rh-vmhp-gvcw
Aug 11, 2026
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system. Fixed in
24.1.6
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41327
GO-2026-5516
GHSA-mrxx-39g5-ph77
Aug 11, 2026
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration. Fixed in
24.1.8
References Updated Aug 11, 2026 · Source: OSV.dev
CVE-2026-41492
GO-2026-5675
GHSA-vvf7-6rmr-m29q
Jul 23, 2026
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster. Fixed in
24.1.9
References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-44840
GO-2026-5837
GHSA-q2m9-6jp9-c6mc
Jul 07, 2026
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. References Updated Jul 23, 2026 · Source: OSV.dev
CVE-2026-41328
GO-2026-5749
GHSA-x92x-px7w-4gx4
Jun 25, 2026
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled. The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response. Fixed in
24.1.9
Updated Jul 23, 2026 · Source: OSV.dev |
v24.0.6-alpha1
pre
Dependencies (64)
+ 56 more |