Loading story…
Dgraph disclosed two high-severity vulnerabilities that allowed unauthenticated attackers to compromise deployments through exposed administrative interfaces and query injection. CVE-2026-40173 affects Dgraph 25.3.1 and earlier and leaks the full process command line through the unauthenticated /debug/pprof/cmdline endpoint, exposing admin tokens passed with the startup flag --security "token=...". Attackers can reuse the stolen token in the X-Dgraph-AuthToken header to reach admin-only endpoints such as /admin/config/cache_mb, enabling unauthorized configuration changes and other privileged operational actions when the Alpha HTTP port is reachable.
A second flaw, CVE-2026-41327, affects versions prior to 25.3.3 and allows pre-authentication full read access to databases running with the default configuration and ACL disabled. The bug is caused by unsafe concatenation of a crafted cond field in an upsert mutation sent to /mutate?commitNow=true, which enables DQL injection and returns server-side query results directly in the HTTP response. Dgraph addressed the issues in 25.3.2 and 25.3.3, respectively, underscoring the risk to internet-exposed instances that had not restricted debug access or hardened authentication settings.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Dgraph fixed CVE-2026-41327 in version 25.3.3. The patch addressed unsafe concatenation in the upsert condition field that allowed server-side DQL query injection and full read access to database contents.
On April 24, 2026, CVE-2026-41327 was disclosed affecting Dgraph versions prior to 25.3.3. The vulnerability allows an unauthenticated attacker to exfiltrate all database data in default configurations without ACL by injecting DQL through the upsert cond field.
Dgraph addressed CVE-2026-40173 in release 25.3.2. The flaw exposed the process command line through an unauthenticated /debug/pprof/cmdline endpoint, which could leak the admin auth token and enable unauthorized access to admin-only endpoints.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the open-source **Dgraph** graph database, tracked as `CVE-2026-34976`, allowed unauthenticated remote attackers to access the GraphQL administration API and invoke the `restoreTenant` mutation without authorization. The flaw, rated `CVSS 10.0`, affected Dgraph `25.3.0` and earlier because `restoreTenant` was omitted from the authorization middleware in `admin.go`, unlike the related `restore` operation that required Guardian-of-Galaxy authentication. By abusing `restoreTenant`, attackers could overwrite databases from attacker-controlled backups, read sensitive local files through `file://` paths, and trigger SSRF requests to internal services, including cloud metadata endpoints. The issue also exposed paths involving S3 or MinIO backup sources, encryption keys, and Vault credentials, creating a risk of complete compromise of confidentiality, integrity, and availability. Dgraph addressed the issue in version `25.3.1`, and defenders were urged to keep administration endpoints such as port `8080` off the public internet and restrict access to trusted internal IPs.
Jun 29, 2026
A high-severity vulnerability, **`CVE-2026-54061`**, affects Dgraph Alpha versions earlier than **`25.3.5`** and allows unauthenticated attackers to reach external snapshot import RPCs exposed on the public gRPC port **`9080`**. The flaw is an authentication bypass (**`CWE-306`**) in which a remote client can send Badger stream data to a target group store without authentication or authorization, enabling direct tampering with database contents over the network. Because the receiving process calls `Prepare()` before processing the imported stream, successful exploitation can delete and replace existing database data, creating high integrity and availability risk. The issue carries a **CVSS v3.1** score vector of **`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`**, and the CVE record indicates proof-of-concept and automatable exploitation with total technical impact. Dgraph addressed the issue in **version `25.3.5`**, which organizations should treat as the fixed release for exposed Alpha deployments.
Jul 9, 2026
Grafana issued urgent patches for two high-severity vulnerabilities, including **`CVE-2026-27876`**, a critical flaw in the SQL Expressions feature that can allow an attacker with **Viewer** privileges or higher to write arbitrary files to the server and potentially escalate to full **remote code execution**. The issue can be chained into broader compromise scenarios, including unauthorized SSH access, prompting public warnings from national defenders such as Belgium’s CCB to patch immediately. Grafana also fixed **`CVE-2026-27880`**, which affects OpenFeature validation endpoints and allows **unauthenticated** attackers to crash vulnerable instances by sending oversized requests that exhaust memory. Grafana Labs said patched releases, including **12.4.2**, are available and noted that **Amazon Managed Grafana** and **Azure Managed Grafana** were already protected under embargo; for temporary mitigation, administrators were advised to disable the `sqlExpressions` feature toggle and use highly available deployments and reverse proxies such as **Nginx** or **Cloudflare** to restrict request sizes.
Jun 29, 2026