CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Unauthenticated attackers can overwrite the database, read server files, and perform SSRF via the restoreTenant mutation due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34976?
CVE-2026-34976 is a critical missing authorization vulnerability in dgraph-io dgraph, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-34976?
9 open source packages ship an affected version, including github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 and github.com/dgraph-io/dgraph/v25. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph Go | All versions | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.0.5 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.0.5 | None |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.1 |
3 more packages
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.1 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.1 |
github.com/hypermodeinc/dgraph/v24 Go | From 24.0.0 | 24.1.6 |
Products include Dgraph Dgraph.
How do I fix CVE-2026-34976?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34976 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34976 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in dgraph-io dgraph
- CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
- CVE-2026-40173 Dgraph: Unauthenticated pprof endpoint leaks admin auth token
- CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
- CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
- CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse
Sources
Also known as GHSA-p5rh-vmhp-gvcw, GO-2026-5529.