CVE-2026-34976 | Dgraph is an open source distributed GraphQL database. Prior… | CVSS 10.0 CRITICAL

Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Metadata

CVE ID: CVE-2026-34976
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-31 19:38 UTC
Published: 2026-04-06 16:12 UTC
Last updated: 2026-04-07 16:00 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: dgraph-io / dgraph
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
dgraph-io	dgraph	—	< 25.3.1

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw