GoPackage

github.com/dgraph-io/dgraph/v24

5 known vulnerabilities (5 critical), with the versions each affects and the releases that fix them.

Latest release: v24.0.5 (Nov 5, 2024): affected by 5 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 5 · 5 critical

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-41492Critical 9.8
Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
Affected: through 24.1.8.
No fix released. The latest release, v24.0.5, is still affected.
CVE-2026-41327Critical 9.1
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
Affected: through 24.1.8.
No fix released. The latest release, v24.0.5, is still affected.
CVE-2026-41328Critical 9.1
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
Affected: through 24.1.8.
No fix released. The latest release, v24.0.5, is still affected.
CVE-2026-40173Critical 9.4
Dgraph: Unauthenticated pprof endpoint leaks admin auth token
Affected: through 24.1.7.
No fix released. The latest release, v24.0.5, is still affected.
CVE-2026-34976Critical 10.0
Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Affected: through 24.0.5.
No fix released. The latest release, v24.0.5, is still affected.