GO-2026-5529
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
At a glance
- Published
- Updated
- CVE
- CVE-2026-34976
- Aliases
- GHSA-p5rh-vmhp-gvcw
Description
The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.1 |
| Go · github.com/hypermodeinc/dgraph/v24 | introduced 24.0.0, fixed 24.1.6 |
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw ADVISORY
- https://github.com/dgraph-io/dgraph/commit/b15c87e9353e36618bf8e0df3bd945c0ce7105ef FIX
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |