Loading story…
A critical vulnerability in the open-source Dgraph graph database, tracked as CVE-2026-34976, allowed unauthenticated remote attackers to access the GraphQL administration API and invoke the restoreTenant mutation without authorization. The flaw, rated CVSS 10.0, affected Dgraph 25.3.0 and earlier because restoreTenant was omitted from the authorization middleware in admin.go, unlike the related restore operation that required Guardian-of-Galaxy authentication.
By abusing restoreTenant, attackers could overwrite databases from attacker-controlled backups, read sensitive local files through file:// paths, and trigger SSRF requests to internal services, including cloud metadata endpoints. The issue also exposed paths involving S3 or MinIO backup sources, encryption keys, and Vault credentials, creating a risk of complete compromise of confidentiality, integrity, and availability. Dgraph addressed the issue in version 25.3.1, and defenders were urged to keep administration endpoints such as port 8080 off the public internet and restrict access to trusted internal IPs.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting disclosed the critical Dgraph vulnerability as CVE-2026-34976 with a CVSS score of 10.0 and warned defenders to restrict access to administration endpoints such as port 8080. One disclosure noted that, at the time of publication, no official patch had yet been released.
Dgraph addressed CVE-2026-34976 in version 25.3.1 by fixing the missing authorization protection around the restoreTenant functionality. The patched release closed the unauthenticated path that could be abused for destructive administrative actions.
A missing authorization check in Dgraph's GraphQL administration API left the restoreTenant mutation accessible without authentication in version 25.3.0 and earlier. The flaw enabled pre-auth database overwrite, server-side file reads via file:// paths, and SSRF using attacker-controlled backup sources and credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dgraph disclosed two high-severity vulnerabilities that allowed unauthenticated attackers to compromise deployments through exposed administrative interfaces and query injection. **`CVE-2026-40173`** affects Dgraph **25.3.1 and earlier** and leaks the full process command line through the unauthenticated **`/debug/pprof/cmdline`** endpoint, exposing admin tokens passed with the startup flag **`--security "token=..."`**. Attackers can reuse the stolen token in the **`X-Dgraph-AuthToken`** header to reach admin-only endpoints such as **`/admin/config/cache_mb`**, enabling unauthorized configuration changes and other privileged operational actions when the Alpha HTTP port is reachable. A second flaw, **`CVE-2026-41327`**, affects versions **prior to 25.3.3** and allows pre-authentication full read access to databases running with the default configuration and **ACL disabled**. The bug is caused by unsafe concatenation of a crafted **`cond`** field in an upsert mutation sent to **`/mutate?commitNow=true`**, which enables **DQL injection** and returns server-side query results directly in the HTTP response. Dgraph addressed the issues in **25.3.2** and **25.3.3**, respectively, underscoring the risk to internet-exposed instances that had not restricted debug access or hardened authentication settings.
Jun 29, 2026
A high-severity vulnerability, **`CVE-2026-54061`**, affects Dgraph Alpha versions earlier than **`25.3.5`** and allows unauthenticated attackers to reach external snapshot import RPCs exposed on the public gRPC port **`9080`**. The flaw is an authentication bypass (**`CWE-306`**) in which a remote client can send Badger stream data to a target group store without authentication or authorization, enabling direct tampering with database contents over the network. Because the receiving process calls `Prepare()` before processing the imported stream, successful exploitation can delete and replace existing database data, creating high integrity and availability risk. The issue carries a **CVSS v3.1** score vector of **`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`**, and the CVE record indicates proof-of-concept and automatable exploitation with total technical impact. Dgraph addressed the issue in **version `25.3.5`**, which organizations should treat as the fixed release for exposed Alpha deployments.
Jul 9, 2026
A critical authentication bypass vulnerability tracked as **CVE-2026-56782** affects **Gorse** before version **0.5.10**, exposing the administrative `/api/dump` and `/api/restore` endpoints to unauthenticated remote access when `admin_api_key` is left empty. The issue is especially serious because the empty key is reported as the default configuration, making internet-exposed deployments vulnerable without additional hardening. The flaw has been rated **9.8** under CVSS 3.1 and **9.3** under CVSS 4.0. Successful exploitation allows attackers to export the entire database, including user records, items, feedback data, and potentially personally identifiable information, or to overwrite the dataset entirely, creating both confidentiality and integrity risks. Advisories recommend upgrading to **Gorse 0.5.10 or later**, setting a strong administrative API key, restricting access to the affected endpoints, and reviewing whether sensitive data may already have been exposed.
Jul 1, 2026