Dgraph-io vulnerabilities

Products

• Dgraph 10

Newest

• dgraph-io dgraph Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service CVE-2026-102748 Fix available 9.2 CriticalOctober 14, 2026
• dgraph-io dgraph Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter CVE-2026-63637 8.6 HighAugust 6, 2026
• dgraph-io dgraph Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVE-2026-54061 Fix available 9.1 CriticalJuly 8, 2026
• dgraph-io dgraph Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query CVE-2026-44840 Public exploitFix available 7.5 HighJune 29, 2026
• dgraph Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph CVE-2026-41492 Fix available 9.8 CriticalApril 24, 2026
• dgraph Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVE-2026-41328 Fix available 9.1 CriticalApril 24, 2026
• dgraph Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVE-2026-41327 Fix available 9.1 CriticalApril 24, 2026
• dgraph Dgraph: Unauthenticated pprof endpoint leaks admin auth token CVE-2026-40173 Fix available 9.4 CriticalApril 15, 2026
• dgraph Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2026-34976 Fix available 10.0 CriticalApril 2, 2026
• dgraph Dgraph Audit Log Encryption nonce reuse CVE-2023-31135 Fix available 3.3 LowMay 17, 2023