CVE-2026-34976
Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
En bref
- Source
- NVD
- EPSS
- EPSS 2.07 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-p5rh-vmhp-gvcw — Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- GO-2026-5529 — Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
Références européennes
- ENISA EUVD · EUVD-2026-19360
- GCVE · GCVE-0-2026-34976
Configurations affectées (CPE NVD)
cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*≤ 25.3.0
Produits affectés
| Produit | Versions |
|---|---|
| dgraph-io · dgraph | affected < 25.3.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |