Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/dgraph-io/dgraph/v25

8 known vulnerabilities (7 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v25.5.1 (Oct 22, 2026): no advisory affects it
Newest unaffected release
v25.5.1 (Oct 22, 2026), the latest release
Advisories
8 · 7 critical, 1 high
Releases
20 since v25.1.0 (Dec 11, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-102748
    Affects v25.1.0-preview1 to v25.4.0-preview1 (v25.4.0 is outside it)
  • CVE-2026-44840
    Affects v25.1.0-preview1 to v25.3.3 (v25.3.4 is outside it)
  • CVE-2026-54061
    Affects v25.1.0-preview1 to v25.3.4 (v25.3.5 is outside it)
  • CVE-2026-41492
    Affects v25.1.0-preview1 to v25.3.2 (v25.3.3 is outside it)
  • CVE-2026-41327
    Affects v25.1.0-preview1 to v25.3.2 (v25.3.3 is outside it)
  • CVE-2026-41328
    Affects v25.1.0-preview1 to v25.3.2 (v25.3.3 is outside it)
  • CVE-2026-40173
    Affects v25.1.0-preview1 to v25.3.1 (v25.3.2 is outside it)
  • CVE-2026-34976
    Affects v25.1.0-preview1 to v25.3.1-preview-federation-changes (v25.3.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2026-102748Critical 9.2

    Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

    Affected: fixed in 25.4.0.

    Fixed in v25.4.0 (released Jul 30, 2026, 76 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Affected: fixed in 25.3.4.

    Fixed in v25.3.4 (released May 11, 2026, 58 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-54061Critical 9.1

    Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

    Affected: fixed in 25.3.5.

    Fixed in v25.3.5 (released Jun 11, 2026, 27 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-41492Critical 9.8

    Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

    Affected: fixed in 25.3.3.

    Fixed in v25.3.3 (released Apr 21, 2026, 3 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-41327Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

    Affected: fixed in 25.3.3.

    Fixed in v25.3.3 (released Apr 21, 2026, 3 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-41328Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

    Affected: fixed in 25.3.3.

    Fixed in v25.3.3 (released Apr 21, 2026, 3 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-40173Critical 9.4

    Dgraph: Unauthenticated pprof endpoint leaks admin auth token

    Affected: fixed in 25.3.2.

    Fixed in v25.3.2 (released Apr 13, 2026, 2 days before disclosure).

    The latest release, v25.5.1, is not affected.

  • CVE-2026-34976Critical 10.0

    Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

    Affected: fixed in 25.3.1.

    Fixed in v25.3.1 (released Apr 1, 2026, 5 days before disclosure).

    The latest release, v25.5.1, is not affected.