Dgraph <=v25.3.0 - Admin Mutation Missing Authorization

Dgraph =v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication. id: CVE-2026-34976 info: name: Dgraph...

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

CVE-2026-44840-poc

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassword GraphQL Docker lab that reproduces a real injection in Dgraph: Vulnerable : dgraph/dgraph:v25.3.3 Patched : dgraph/dgraph:v25.3.4 Real CVE from 2026 · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Query Logic ·...

GO-2026-6865 vulnerabilities

Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...

CVE-2026-116591 vulnerabilities

Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...

GHSA-FPMH-FRQ8-7RJ8 vulnerabilities

Vulnerabilities for packages: crossplane, eksctl, kubeflow-pipelines, datadog-agent, k3s, distribution, newrelic-fluent-bit-output, timoni, neuvector-scanner, flux, wal-g, scorecard, tfsec, nri-kafka, terragrunt, percona-server-mongodb-operator, slsa-verifier, witness, kaniko, skaffold, velero,...

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Summary Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable. The exposed routes include: - /state - /assign - /removeNode - /moveTablet An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks th...

EUVD-2026-101603

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service...

GHSA-QJ98-GP63-54XJ Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Summary Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable. The exposed routes include: - /state - /assign - /removeNode - /moveTablet An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks th...

CVE-2026-102748

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

CVE-2026-102748

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

CVE-2026-102748

Dgraph, an open source distributed GraphQL database, is vulnerable to a Denial of Service in versions prior to 25.4.0 . When the administrative interface is enabled, Dgraph Zero registers several unauthenticated administrative HTTP routes on port 6080, specifically in dgraph/cmd/zero/run.go. An u...

CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

CVE-2026-102748 Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

PT-2026-113943

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...

CVE-2026-102748: Missing Authentication for Critical Function

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to...

Exploit for CVE-2026-44840

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: crossplane, secrets-store-csi-driver, spire-controller-manager, kargo, rancher, crossplane-provider-family-azure, secrets-store-csi-driver-provider-aws, kuma, temporal-ui-server, scorecard, kube-arangodb, gitaly, kubernetes-csi-node-driver-registrar,...

SUSE CVE-2026-34976

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...