CVE-2026-34976

CRITICALNuclei

Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-34976 has a selected CVSS score of 10.0 (critical); EIP currently links 1 Nuclei template.

Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 7, 2026 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

dgraph

Browse dgraph-io / dgraph
CVE List< 25.3.1affected

github.com/dgraph-io/dgraph

Browse Go / github.com/dgraph-io/dgraph
GitHub AdvisoryThrough 1.2.8affected

github.com/dgraph-io/dgraph/v24

Browse Go / github.com/dgraph-io/dgraph/v24
GitHub AdvisoryThrough 24.0.5affected

github.com/dgraph-io/dgraph/v25

Browse Go / github.com/dgraph-io/dgraph/v25
GitHub AdvisoryBefore 25.3.1 · Fixed in 25.3.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALDgraph <=v25.3.0 - Admin Mutation Missing AuthorizationCVSS 10

Dgraph <=v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.

Impact

Unauthenticated attackers can overwrite the database, read server files, and perform SSRF, leading to full data compromise and server access.

Remediation

Update to version 25.3.1 or later.

WeaknessesCWE-862
Authorsstr4k3r
Template tagscvecve2026dgraphauth-bypassssrf
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Shodan: title:"Dgraph"
FOFA: body="dgraph"
https://github.com/hypermodeinc/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw https://nvd.nist.gov/vuln/detail/CVE-2026-34976

Source: ProjectDiscovery

References

5