Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hypermodeinc/dgraph/v24

6 known vulnerabilities (5 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
v24.1.9 (May 11, 2026): affected by CVE-2026-44840
Newest unaffected release
Every release is affected by at least one advisory
Advisories
6 · 5 critical, 1 high
Releases
16 since v24.1.0 (Mar 6, 2025)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    Affected: all versions.

    No fix released. The latest release, v24.1.9, is still affected.

  • CVE-2026-41492Critical 9.8

    Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

    Affected: fixed in 24.1.9.

    Fixed in v24.1.9 (released May 11, 2026, 17 days after disclosure).

    The latest release, v24.1.9, is not affected.

  • CVE-2026-41327Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

    Affected: fixed in 24.1.8.

    Fixed in v24.1.8 (released Apr 21, 2026, 3 days before disclosure).

    The latest release, v24.1.9, is not affected.

  • CVE-2026-41328Critical 9.1

    Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

    Affected: fixed in 24.1.9.

    Fixed in v24.1.9 (released May 11, 2026, 17 days after disclosure).

    The latest release, v24.1.9, is not affected.

  • CVE-2026-40173Critical 9.4

    Dgraph: Unauthenticated pprof endpoint leaks admin auth token

    Affected: fixed in 24.1.9.

    Fixed in v24.1.9 (released May 11, 2026, 26 days after disclosure).

    The latest release, v24.1.9, is not affected.

  • CVE-2026-34976Critical 10.0

    Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

    Affected: from 24.0.0, fixed in 24.1.6.

    Fixed in v24.1.6 (released Apr 1, 2026, 5 days before disclosure).

    The latest release, v24.1.9, is not affected.