PkgSeer

Vulnerability GO-2026-5529

Unknown

2 months ago

Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8

Summary

Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

Details

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

v25.0.0-custom-qt-improv-1 - v25.4.0-preview1 GHSA-qj98-gp63-54xj

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.4 GO-2026-6261

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.4 GO-2026-6261

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

v25.0.0-custom-qt-improv-1 - v25.3.4 GHSA-rrwh-6jrq-wp5v

Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8 GO-2026-5274

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

2 months ago

Fixed (v25.3.1)

6 months ago

Fixed (v24.1.6)

6 months ago

Last Modified

2 months ago