Dgraph-io vulnerabilities
We track 9 vulnerabilities in Dgraph-io products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Dgraph-io vulnerabilities
- 9.2 Critical severity
dgraph: Missing Authentication for Critical Functionality
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and
- 8.6 High severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or
- 9.1 Critical severity
dgraph: Missing Authentication for Critical Functionality
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network cli
- 7.5 High severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd
- 9.8 Critical severity
dgraph: Exposure of Sensitive Information to an Unauthorized Actor
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag
- 9.1 Critical severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where A
- 9.1 Critical severity
dgraph: Improper Neutralization of Special Elements in Data Query Logic
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where A
- 9.4 Critical severity
dgraph: Insufficiently Protected Credentials
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, expos
- 10.0 Critical severity
dgraph: Missing Authorization
Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Gu