Hasura

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Hasura records in CISA KEV

No Hasura vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Graphql Engine 8 records HIGH

Records

8 records in Graphql Engine · all components

TI-2021-22365 CVE-2021-47748 · GHSA-4v6h-qhxp-2wqw

Hasura GraphQL 1.3.3 - Remote Code Execution

HIGH 81

Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01131 Published 2026-01-21 No fix listed CWE-78

TI-2021-22330 CVE-2021-47713 · GHSA-c963-4j6g-xhmv

Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query

HIGH 77

Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00481 Published 2025-12-22 No fix listed CWE-770

TI-2021-22331 CVE-2021-47714 · GHSA-rghc-mxjc-cmxr

Hasura GraphQL 1.3.3 Local File Read via SQL Injection

HIGH 70

Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00217 Published 2025-12-22 No fix listed CWE-89

TI-2022-23138 CVE-2022-46792 · GHSA-jfv6-7jf3-3v86

Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many…

MEDIUM 42

Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00879 Published 2022-12-08 No fix listed CWE-863

TI-2023-12298 CVE-2023-27588

Unauthenticated path traversal vulnerability in Hasura GraphQL Engine

MEDIUM 41

Hasura is an open-source product that provides users GraphQL or REST APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01302 Published 2023-03-14 Fixed in 1.3.4, 2.11.5 +1 CWE-22

TI-2021-22332 CVE-2021-47715 · GHSA-8p9c-w6fc-vjgh

Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

LOW 37

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00384 Published 2025-12-22 No fix listed CWE-918

TI-2019-16093 CVE-2019-1020015 · GHSA-xgqc-x32m-2j5c

graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.

LOW 35

graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0118 Published 2019-07-29 Fixed in 1.0.0-beta.3

TI-2026-39518 CVE-2026-54698

Hasura: Row-level authorization bypass on table computed fields

LOW 27

Hasura is an open-source product that provides users GraphQL or REST APIs.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00275 Published 2026-07-07 Fixed in 2.49.2, 2.45.5 CWE-863

Open these records in search →

Critical	1
High	4
Medium	3
Low	0
No CVSS	0