CVE catalog

CVE-2026-34976

Severity: Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: Apr 6, 2026, 5:17:11 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.07% · Oct 25, 2026

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	dgraph	Not reported	Not reported	unknown
Go	github.com/dgraph-io/dgraph	Not reported	Not reported	unknown
Go	github.com/dgraph-io/dgraph/v25	Not reported	`25.3.1`	fixed
Go	github.com/hypermodeinc/dgraph/v24	Not reported	`24.1.6`	fixed
Cpe	dgraph	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Go	github.com/dgraph-io/dgraph/v25	Go	Not reported	`25.3.1`	Not reported	Not reported	Not reported
Go	github.com/hypermodeinc/dgraph/v24	Go	Not reported	`24.1.6`	Not reported	Not reported	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 24, 2026, 5:22:23 PM UTC

References

[FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)]