CRITICAL9.4Go
GHSA-95mq-xwj4-r47p· CVE-2026-40173, GO-2026-5274Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
Modified: 9/10/2026
package
Go/github.com/dgraph-io/dgraph/v25
pkg:go/github.com/dgraph-io/dgraph/v25
CRITICAL9.1Go
GHSA-mrxx-39g5-ph77· CVE-2026-41327, GO-2026-5516Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
Modified: 9/10/2026
CRITICAL10.0Go
GHSA-p5rh-vmhp-gvcw· CVE-2026-34976, GO-2026-5529Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Modified: 9/10/2026
HIGH7.5Go
GHSA-q2m9-6jp9-c6mc· CVE-2026-44840, GO-2026-5837Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Modified: 7/7/2026
CRITICAL9.1Go
GHSA-rrwh-6jrq-wp5v· CVE-2026-54061, GO-2026-6261Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Modified: 9/10/2026
CRITICAL9.8Go
GHSA-vvf7-6rmr-m29q· CVE-2026-41492, GO-2026-5675Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
Modified: 9/10/2026
CRITICAL9.1Go
GHSA-x92x-px7w-4gx4· CVE-2026-41328, GO-2026-5749Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
Modified: 9/10/2026
—Go
GO-2026-5274· CVE-2026-40173, GHSA-95mq-xwj4-r47pDgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph
Modified: 8/11/2026
—Go
GO-2026-5516· CVE-2026-41327, GHSA-mrxx-39g5-ph77Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph
Modified: 8/11/2026
—Go
GO-2026-5529· CVE-2026-34976, GHSA-p5rh-vmhp-gvcwUnauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
Modified: 8/11/2026
—Go
GO-2026-5675· CVE-2026-41492, GHSA-vvf7-6rmr-m29qUnauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
Modified: 7/23/2026
—Go
GO-2026-5749· CVE-2026-41328, GHSA-x92x-px7w-4gx4DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph
Modified: 7/23/2026
—Go
GO-2026-5837· CVE-2026-44840, GHSA-q2m9-6jp9-c6mcDQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph
Modified: 7/23/2026
—Go
GO-2026-6261· CVE-2026-54061, GHSA-rrwh-6jrq-wp5vDgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph
Modified: 8/26/2026