Missing Authentication

github.com/dgraph-io/dgraph is vulnerable to Missing Authentication. The vulnerability is due to the restoreTenant admin mutation missing authorization middleware validation, which allows an unauthenticated attacker to overwrite the database, access server-side files via file:// paths, and perfor...

Unauthenticated Credential Disclosure

github.com/dgraph-io/dgraph is vulnerable to an unauthenticated credential disclosure. The vulnerability is due to the /debug/pprof/cmdline endpoint being accessible without authentication, which exposes the full process command line including the admin token, allowing an attacker to retrieve the...

GHSA-MRXX-39G5-PH77 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41327 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41328 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41492 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-VVF7-6RMR-M29Q vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-X92X-PX7W-4GX4 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-X92X-PX7W-4GX4 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41492 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-MRXX-39G5-PH77 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41328 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-41327 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-VVF7-6RMR-M29Q vulnerabilities

Vulnerabilities for packages: dgraph...

Improper Neutralization of Special Elements in Data Query Logic

Overview github.com/dgraph-io/dgraph/edgraph is a Dgraph is a horizontally scalable and distributed GraphQL database with a graph backend. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the cond field in an upsert mutation. ...

Improper Neutralization of Special Elements in Data Query Logic

Overview github.com/dgraph-io/dgraph/v25/edgraph is a Dgraph is a horizontally scalable and distributed GraphQL database with a graph backend. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the cond field in an upsert...

Improper Neutralization of Special Elements in Data Query Logic

Overview github.com/dgraph-io/dgraph/v25/edgraph is a Dgraph is a horizontally scalable and distributed GraphQL database with a graph backend. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the addQueryIfUnique function. An...

Improper Neutralization of Special Elements in Data Query Logic

Overview github.com/dgraph-io/dgraph/edgraph is a Dgraph is a horizontally scalable and distributed GraphQL database with a graph backend. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the addQueryIfUnique function. An...

CVE-2026-41327

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a...

CVE-2026-41328

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack require...