CVE-2026-34976
CriticalPublic exploitDgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Published Apr 2, 2026 · Updated Sep 29, 2026 · Also known as GHSA-p5rh-vmhp-gvcw, GO-2026-5529
Key Facts
Patch immediately- CVE-2026-34976 is a critical-severity vulnerability (CVSS 10.0 v3.1) affecting Dgraph, github.com/dgraph-io/dgraph (go), github.com/dgraph-io/dgraph/v24 (go) and 2 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 1.7% probability of exploitation in the next 30 days.
- Fixed versions are available, including Dgraph 25.3.1-r0, Dgraph 25.3.0, github.com/dgraph-io/dgraph/v25 25.3.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v3.1
10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
1.7%
Higher than 76.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-34976 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
Affected Products
8 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DgraphDgraph | >= < 25.3.1 | 25.3.0 |
| github.com/dgraph-io/dgraphgo | See advisory | n/a |
| github.com/dgraph-io/dgraph/v24go | See advisory | n/a |
| github.com/dgraph-io/dgraph/v25go | See advisory | 25.3.1 |
| github.com/hypermodeinc/dgraph/v24go | >= 24.0.0 | 24.1.6 |
Patched Releases
Dgraph
25.3.1-r0, 25.3.0
github.com/dgraph-io/dgraph/v25
25.3.1
github.com/hypermodeinc/dgraph/v24
24.1.6
Timeline
Publicly disclosed
Apr 2, 2026
Last updated
Sep 29, 2026
Weakness Type
- CWE-862 Missing Authorization
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34976.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-34976
- articlehttps://github.com/dgraph-io/dgraph/commit/b15c87e9353e36618bf8e0df3bd945c0ce7105ef
- articlehttps://github.com/dgraph-io/dgraph/releases/tag/v25.3.1
FAQ
Common Questions.
Dgraph is an open source distributed GraphQL database.
Affected: Dgraph versions >= < 25.3.1; github.com/dgraph-io/dgraph (go); github.com/dgraph-io/dgraph/v24 (go), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Dgraph 25.3.1-r0, Dgraph 25.3.0, github.com/dgraph-io/dgraph/v25 25.3.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-34976 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo