CVE-2026-34976 Details
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
A critical vulnerability exists in Dgraph versions prior to 25.3.1, where the restoreTenant admin mutation lacks proper authorization, leaving it completely unauthenticated. This mutation, unlike the similar restore mutation that requires authentication, can be exploited to overwrite entire databases, read server-side files, and perform server-side request forgery (SSRF) attacks. The vulnerability arises because the restoreTenant mutation is not included in the authorization middleware configuration, allowing unauthorized access to its functionality. Exploitation involves sending a request to the admin endpoint with a crafted backup source URL, S3/MinIO credentials, or file paths, which the server processes without authentication.
Users should update to Dgraph version 25.3.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dgraph dgraph | <= 25.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |