# github.com/dgraph-io/dgraph (Go) vulnerabilities 8 known vulnerabilities (6 critical, 1 high, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.2.8 (Oct 28, 2020): affected by 8 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 111 since v0.4.0 (Jul 11, 2016) - Registry: https://pkg.go.dev/github.com/dgraph-io/dgraph - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44840: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-54061: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-41492: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-41327: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-41328: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-40173: v0.4.0 to v1.2.8 (through the newest release) - CVE-2026-34976: v0.4.0 to v1.2.8 (through the newest release) - CVE-2023-31135: v0.4.0 to v1.2.8 (through the newest release) ## Advisories (8) ### [CVE-2026-44840](https://cve.now/CVE-2026-44840): Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: all versions. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-54061](https://cve.now/CVE-2026-54061): Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import - Severity: Critical 9.1 - Published: Jul 8, 2026 - Affected: all versions. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-41492](https://cve.now/CVE-2026-41492): Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph - Severity: Critical 9.8 - Published: Apr 24, 2026 - Affected: all versions; through 1.2.8. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-41327](https://cve.now/CVE-2026-41327): Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field - Severity: Critical 9.1 - Published: Apr 24, 2026 - Affected: all versions; through 1.2.8. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-41328](https://cve.now/CVE-2026-41328): Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field - Severity: Critical 9.1 - Published: Apr 24, 2026 - Affected: through 1.2.8; all versions. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-40173](https://cve.now/CVE-2026-40173): Dgraph: Unauthenticated pprof endpoint leaks admin auth token - Severity: Critical 9.4 - Published: Apr 15, 2026 - Affected: through 1.2.8; all versions. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2026-34976](https://cve.now/CVE-2026-34976): Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization - Severity: Critical 10.0 - Published: Apr 6, 2026 - Affected: through 1.2.8; all versions. - No fix released. The latest release, v1.2.8, is still affected. ### [CVE-2023-31135](https://cve.now/CVE-2023-31135): Dgraph Audit Log Encryption nonce reuse - Severity: Low 3.3 - Published: May 17, 2023 - Affected: fixed in 23.0.0. - No fix released. The advisory names 23.0.0 as the fix, which the registry doesn't have yet. The latest release, v1.2.8, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/dgraph-io/dgraph Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.