GO-2026-5529
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
Quick fix
GO-2026-5529 — github.com/dgraph-io/dgraph/v25: upgrade to the fixed version with the command below.
go get github.com/dgraph-io/dgraph/v25@v25.3.1Details
The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.
An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
0 Fixed in: 25.3.1 go get github.com/dgraph-io/dgraph/v25@v25.3.1 24.0.0 Fixed in: 24.1.6 go get github.com/hypermodeinc/dgraph/v24@v24.1.6