CVE-2026-34976 - Vulnerability Analysis

Overview

Dgraph < 25.3.1 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can overwrite the database, read server files, and perform SSRF, leading to full data compromise and server access.

Mitigation

Update to version 25.3.1 or later.

References

• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner