CVE-2026-34976

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

CVE-2026-34976

CVE-2026-34976 affects Dgraph prior to 25.3.1 where the restoreTenant admin mutation is missing from the authorization middleware, allowing an unauthenticated attacker to specify attacker-controlled backup locations (including file://), S3/MinIO credentials, encryption key paths, and Vault IDs. T...

CVE-2026-34976: Missing Authorization

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config admin.go, making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication,...

Dgraph 安全漏洞

Dgraph is an open-source, horizontally scalable distributed GraphQL database with a graphical backend. Versions of Dgraph prior to 25.3.1 contained a security vulnerability. This vulnerability stemmed from a flaw in the restoreTenant management mechanism, which lacked an authorization middleware...

GHSA-P5RH-VMHP-GVCW vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-34976 vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-34976 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-P5RH-VMHP-GVCW vulnerabilities

Vulnerabilities for packages: dgraph...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: dagger, eksctl, maru, teleport, nfpm, goreleaser, malcontent, k8sgpt, k3s, lazygit, nuclei, tempo, opentelemetry-collector-contrib, kubevela, mcp-grafana, ollama, prometheus, loki, terragrunt, dgraph, datadog-agent, grafana, cri-tools, terraform-mcp-server, weaviate,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: trufflehog, trillian, nri-mysql, flux-kustomize-controller, hydra, spire-server, tkn, tailscale, cerbos, k3s, caddy, timestamp-authority, nuclei, openbao, telegraf, ratify, dex, kine, age, aactl, gitsign, loki, envoy-gateway, temporal, dgraph, rekor, terragrunt, croc...

CVE-2020-15112 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-M332-53R6-2W93 vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-M332-53R6-2W93 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

CVE-2020-15112 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, k9s, kubescape, nuclei, opentelemetry-collector-contrib, kratos, mkcert, k6, octo-sts, restic, nsc, tfsec, percona-server-mongodb-operator, protoc-gen-go-grpc, ingress-nginx-controller, sftpgo-plugin-eventsearch, paranoia, seaweedfs,...

EUVD-2023-1505

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: dapr, k8sgateway, cluster-api, kind, gobump, neuvector-sigstore-interface, rancher, fulcio, opentofu, k3d, kube-bench, swagger, timescaledb-tune, vault, docker-credential-gcr, nri-haproxy, wal-g, regclient, witness, karpenter, cis-operator, oauth2-proxy, nri-mysql,...

CVE-2023-31135

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, sonobuoy, terraform-docs, helm, melange, boring-registry-fips, smarter-device-manager, conftest-fips, prometheus-pushgateway, pulumi-kubernetes-operator, flannel, kind, prometheus-pushgateway-fips, snyk-cli, spqr, atlantis-fips,...