CRITICAL9.4Go
GHSA-95mq-xwj4-r47p· CVE-2026-40173, GO-2026-5274Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
Modified: 9/10/2026
package
Go/github.com/dgraph-io/dgraph/v24
pkg:go/github.com/dgraph-io/dgraph/v24
CRITICAL9.1Go
GHSA-mrxx-39g5-ph77· CVE-2026-41327, GO-2026-5516Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
Modified: 9/10/2026
CRITICAL10.0Go
GHSA-p5rh-vmhp-gvcw· CVE-2026-34976, GO-2026-5529Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Modified: 9/10/2026
CRITICAL9.8Go
GHSA-vvf7-6rmr-m29q· CVE-2026-41492, GO-2026-5675Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
Modified: 9/10/2026
CRITICAL9.1Go
GHSA-x92x-px7w-4gx4· CVE-2026-41328, GO-2026-5749Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
Modified: 9/10/2026