Vulnerabilities

TI-2026-74405 CVE-2026-102748 · GHSA-qj98-gp63-54xj

Unauthenticated admin HTTP routes in Dgraph Zero allow node removal

MEDIUM 49

Dgraph is an open source distributed GraphQL database.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00615 Published 2026-10-14 Fixed in 25.4.0 CWE-306

TI-2026-45279 CVE-2026-63637

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

HIGH 76

Dgraph is an open source distributed GraphQL database.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00408 Published 2026-08-06 Fixed in 25.3.8 CWE-943

TI-2026-32720 CVE-2026-44840 · GHSA-q2m9-6jp9-c6mc

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

HIGH 72

Dgraph is an open source distributed GraphQL database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00527 Published 2026-07-08 Fixed in 25.3.4 CWE-943

TI-2026-38995 CVE-2026-54061 · GHSA-rrwh-6jrq-wp5v

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

HIGH 80

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00467 Published 2026-07-08 Fixed in 25.3.5 CWE-306

TI-2026-30079 CVE-2026-41492 · GHSA-vvf7-6rmr-m29q

Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

HIGH 82

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03082 Published 2026-04-24 Fixed in 25.3.3 CWE-200

TI-2026-29928 CVE-2026-41327 · GHSA-mrxx-39g5-ph77

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

HIGH 78

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0049 Published 2026-04-24 Fixed in 25.3.3 CWE-943

TI-2026-29929 CVE-2026-41328 · GHSA-x92x-px7w-4gx4

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

HIGH 80

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00415 Published 2026-04-24 Fixed in 25.3.3 CWE-943

TI-2026-28987 CVE-2026-40173 · GHSA-95mq-xwj4-r47p

Dgraph: Unauthenticated pprof endpoint leaks admin auth token

HIGH 82

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00509 Published 2026-04-15 Fixed in 25.3.2 CWE-200

TI-2026-27198 CVE-2026-34976 · GHSA-p5rh-vmhp-gvcw

Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

HIGH 82

Dgraph is an open source distributed GraphQL database.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02066 Published 2026-04-06 Fixed in 25.3.1 CWE-862

TI-2023-14845 CVE-2023-31135 · GHSA-92wq-q9pq-gw47

Dgraph Audit Log Encryption nonce reuse

LOW 24

Dgraph is an open source distributed GraphQL database.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00153 Published 2023-05-17 Fixed in 23.0.0 CWE-326

Vulnerabilities

Filters