Skip to content
OpenAdvisories

Product · hasura

graphql-engine

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.0
    CVE-2026-54698

    Hasura: Row-level authorization bypass on table computed fields

    Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on s…

    hasura graphql-engine