Repository navigation
Security: dgraph-io/dgraph
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Zero Unauthenticated HTTP Admin removeNode Denial of ServiceGHSA-qj98-gp63-54xj published
Aug 2, 2026 by matthewmcneelyCritical -
DQL Injection via unvalidated regexp filter argument in GraphQL query rewriterGHSA-33p8-wc97-5qcj published
Jul 17, 2026 by matthewmcneelyHigh -
Unauthenticated external snapshot import can replace Dgraph Alpha group storesGHSA-rrwh-6jrq-wp5v published
Jun 13, 2026 by matthewmcneelyCritical -
CWE-943: DQL Injection via checkUserPassword GraphQL QueryGHSA-q2m9-6jp9-c6mc published
Jun 29, 2026 by matthewmcneelyHigh -
Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in DgraphGHSA-vvf7-6rmr-m29q published
Apr 22, 2026 by matthewmcneelyCritical -
Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpointsGHSA-95mq-xwj4-r47p published
Apr 15, 2026 by matthewmcneelyCritical -
Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization (CVSS 10.0)GHSA-p5rh-vmhp-gvcw published
Apr 2, 2026 by matthewmcneelyCritical -
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldGHSA-x92x-px7w-4gx4 published
Apr 22, 2026 by matthewmcneelyCritical -
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldGHSA-mrxx-39g5-ph77 published
Apr 22, 2026 by matthewmcneelyCritical -
Dgraph Audit Log Encryption VulnerabilityGHSA-92wq-q9pq-gw47 published
May 17, 2023 by skrdgraphLow