CVE-2026-54698 Details
Description
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
A row-level authorization bypass vulnerability has been identified in Hasura GraphQL Engine versions prior to 2.49.2 and in the 2.45.0 to 2.45.5 range. The issue arises in table computed fields that return 'SETOF some_table', allowing users to infer row values that should be filtered based on their role's row-level permissions. Although the inferred rows cannot be directly accessed, 'like' predicates on strings can be used to efficiently brute-force values through the 'where' clause, effectively exploiting the vulnerability.
Users can upgrade to Hasura GraphQL Engine versions 2.49.2 or 2.45.5, both of which include the necessary fix. For deployments that cannot upgrade immediately, the affected computed field can be untracked from the Hasura Graph Engine metadata as a temporary workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hasura graphql engine | >= 2.45.0, <= 2.45.5 >= 2.46.0, <= 2.49.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |