Critical Dgraph Database Flaw Allowed Attackers to Bypass Authentication

A newly discovered critical vulnerability in the open-source Dgraph database system leaves servers exposed to complete system takeovers.

Tracked as CVE-2026-34976 and carrying a maximum CVSS score of 10.0, this missing authorization flaw allows remote, unauthenticated attackers to overwrite databases, read sensitive server files, and launch Server-Side Request Forgery (SSRF) attacks.

Currently, all Dgraph versions up to v25.3.0 are affected, and an official patched release is not yet available.

The vulnerability stems from a straightforward oversight in the database’s access control configuration.

In Dgraph, administrative commands are typically protected by security middleware that enforces authentication, IP whitelisting, and audit logging.

While the standard restore command is securely guarded, a similar administrative action called restoreTenant was accidentally omitted from the protected list.

Because this specific command skips all security checks, anyone who can reach the server’s admin network endpoint can execute it.

An attacker requires zero credentials, security tokens, or prior system access to compromise the database.

Security researcher Koda Reef discovered that the exposed restoreTenant function accepts external URLs to process database backups. This flaw enables several devastating exploitation paths:

• Database overwriting occurs when attackers host a malicious backup file on a public cloud bucket and point the vulnerable command at it, forcing Dgraph to replace the existing database with attacker-controlled data.
• Local file probing is achieved using standard file path requests, where detailed error messages returned by the server reveal the contents of sensitive system directories.
• SSRF attacks are launched by supplying internal IP addresses to the command, forcing the database server to interact with restricted internal services or leak cloud environment metadata.
• Credential theft is possible because the command can be manipulated to improperly read internal Kubernetes service account tokens or system password files.

Because there are no patched versions currently available, organizations using Dgraph must rely on temporary workarounds or source code modifications.

The permanent code-level fix requires adding the restoreTenant mutation to the database’s administrative middleware mapping, which instantly restores standard authentication checks.

Until an official security update is distributed, administrators are strongly urged to severely restrict network access to Dgraph admin endpoints.

Blocking public external access to the administrative port and enforcing strict firewall rules is the best immediate defense against this critical threat.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.