dgraph-io vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20269

Newest CVEs

• CVE-2026-102748

  Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

  dgraph-io · dgraph

  Critical9.2
• CVE-2026-63637

  Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

  dgraph-io · dgraph

  High8.6
• CVE-2026-44840

  Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

  dgraph-io · dgraph

  High7.5
• CVE-2026-54061

  Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

  dgraph-io · dgraph

  Critical9.1
• CVE-2026-41492

  Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

  dgraph-io · dgraph

  Critical9.8
• CVE-2026-41327

  Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

  dgraph-io · dgraph

  Critical9.1
• CVE-2026-41328

  Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

  dgraph-io · dgraph

  Critical9.1
• CVE-2026-40173

  Dgraph: Unauthenticated pprof endpoint leaks admin auth token

  dgraph-io · dgraph

  Critical9.4
• CVE-2026-34976

  Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

  dgraph-io · dgraph

  Critical10.0
• CVE-2023-31135

  Dgraph Audit Log Encryption nonce reuse

  dgraph-io · dgraph

  Low3.3