Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dgraph-io | dgraph | < 25.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | dgraph | 25.3.1-r0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Dgraph <=v25.3.0 - Admin Mutation Missing Authorization http/cves/2026/CVE-2026-34976.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/dgraph-io/dgraph | <= 1.2.8 | — | GHSA-p5rh-vmhp-gvcw |
| Go | github.com/dgraph-io/dgraph | all versions | — | GO-2026-5529 |
| Go | github.com/dgraph-io/dgraph/v24 | <= 24.0.5 | — | GHSA-p5rh-vmhp-gvcw |
| Go | github.com/dgraph-io/dgraph/v25 | < 25.3.1 | 25.3.1 | GHSA-p5rh-vmhp-gvcw |
| Go | github.com/hypermodeinc/dgraph/v24 | >= 24.0.0, < 24.1.6 | 24.1.6 | GO-2026-5529 |
Advisories 2
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026