CVE-2026-34976

Katalog CVE

CVSS 10.0 · Critical EPSS 1,7%

Kerentanan Missing Authorization pada dgraph. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Rincian

Terbit di NVD

6 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 75,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw exploit · advisory vendor