Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/dgraph-io/dgraph

8 known vulnerabilities (6 critical, 1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
v1.2.8 (Oct 28, 2020): affected by 8 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
8 · 6 critical, 1 high, 1 low
Releases
111 since v0.4.0 (Jul 11, 2016)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Affected: all versions.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-54061Critical 9.1

    Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

    Affected: all versions.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-41492Critical 9.8

    Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

    Affected: all versions; through 1.2.8.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-41327Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

    Affected: all versions; through 1.2.8.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-41328Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

    Affected: through 1.2.8; all versions.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-40173Critical 9.4

    Dgraph: Unauthenticated pprof endpoint leaks admin auth token

    Affected: through 1.2.8; all versions.

    No fix released. The latest release, v1.2.8, is still affected.

  • CVE-2026-34976Critical 10.0

    Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

    Affected: through 1.2.8; all versions.

    No fix released. The latest release, v1.2.8, is still affected.

  • Dgraph Audit Log Encryption nonce reuse

    Affected: fixed in 23.0.0.

    No fix released. The advisory names 23.0.0 as the fix, which the registry doesn't have yet. The latest release, v1.2.8, is still affected.