Skip to content
OpenAdvisories

Package · Go

github.com/dgraph-io/dgraph

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • High 7.5
    CVE-2026-44840 Public exploit

    Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpw…

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 9.1
    CVE-2026-54061

    Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

    Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network cl…

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 9.8
    CVE-2026-41492

    Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

    Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup fla…

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 9.1
    CVE-2026-41327

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

    Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where …

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 9.1
    CVE-2026-41328

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

    Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where …

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 9.4
    CVE-2026-40173

    Dgraph: Unauthenticated pprof endpoint leaks admin auth token

    Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, expo…

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Critical 10.0
    CVE-2026-34976

    Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

    Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires G…

    dgraph-io dgraph github.com/dgraph-io/dgraph/v25 github.com/dgraph-io/dgraph Go
  • Low 3.3
    CVE-2023-31135

    Dgraph Audit Log Encryption nonce reuse

    Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come fro…

    dgraph-io dgraph github.com/dgraph-io/dgraph Go