GO-2026-5529
Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph
빠른 조치
GO-2026-5529 — github.com/dgraph-io/dgraph/v25: 아래 명령으로 수정 버전으로 올리세요.
go get github.com/dgraph-io/dgraph/v25@v25.3.1상세
The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.
An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
0 No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
0 수정 버전: 25.3.1 go get github.com/dgraph-io/dgraph/v25@v25.3.1 24.0.0 수정 버전: 24.1.6 go get github.com/hypermodeinc/dgraph/v24@v24.1.6