Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization (dgraph-io dgraph)
At a glance
- Source
- NVD
- EPSS
- EPSS 2.07 % · percentile 81 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
Advisories
- GHSA-p5rh-vmhp-gvcw — Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- GO-2026-5529 — Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
European references
- ENISA EUVD · EUVD-2026-19360
- GCVE · GCVE-0-2026-34976
Affected configurations (NVD CPE)
cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*≤ 25.3.0
Affected products
| Product | Versions |
|---|---|
| dgraph-io · dgraph | affected < 25.3.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |