Read the docs
TI-2026-39518 Aliases CVE-2026-54698

Hasura: Row-level authorization bypass on table computed fields

Priority LOW 27CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 19th percentileScored 2026-11-07
Fix Fixed graphql-engine (hasura): 2.49.2, 2.45.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hasuragraphql-engine2.46.0 to before 2.49.2; 2.45.0 to before 2.45.52.49.2, 2.45.5Patch availableCNA
  • graphql-engine VendorHasura Affected 2.46.0 to before 2.49.2; 2.45.0 to before 2.45.5 Fixed in 2.49.2, 2.45.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*2.45.0 – 2.45.5; 2.46.0 – 2.49.2VulnerableHasura
  • cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:* Versions 2.45.0 – 2.45.5; 2.46.0 – 2.49.2 Vulnerable ·Hasura

Remediation

  • Fix · CNA graphql-engine (hasura) Fixed in 2.49.2, 2.45.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54698

References

Advisory 1

  • TI-2021-22365 Hasura GraphQL 1.3.3 - Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2021-22330 Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query CVSS 4.0HIGH 8.7
  • TI-2021-22331 Hasura GraphQL 1.3.3 Local File Read via SQL Injection CVSS 4.0MEDIUM 6.9
  • TI-2022-23138 Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many… CVSS 3.1HIGH 8.8
  • TI-2023-12298 Unauthenticated path traversal vulnerability in Hasura GraphQL Engine CVSS 3.1HIGH 7.5
  • TI-2021-22332 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences