CVE-2026-34976: GO-2026-5529 - Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

CVE-2026-34976 · Severity: critical · CVSS 10 · Published 2026-04-06

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Technologies: Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go), github.com/dgraph-io/dgraph/v25 (Go), github.com/hypermodeinc/dgraph/v24 (Go). Vendors: Dgraph, Go.

Quick answers

Is CVE-2026-34976 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34976 being exploited in the wild.
How severe is CVE-2026-34976?
Critical severity, with a CVSS score of 10, published 6 April 2026.
Which products and versions are affected?
github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8; github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.0.5; github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.1; github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=24.0.0,fixed=24.1.6.
Is there a fix for CVE-2026-34976?
Yes. github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.1 or later; github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-34976?
Check whether you run Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.1 or later
    go get github.com/dgraph-io/dgraph/v25@v25.3.1
  • github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.6 or later
    go get github.com/hypermodeinc/dgraph/v24@v24.1.6

Affected products

  • Dgraph
  • github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8
  • github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.0.5
  • github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.1
  • github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=24.0.0,fixed=24.1.6

Identifiers

  • CVE-2026-34976
  • GHSA-p5rh-vmhp-gvcw
  • GO-2026-5529

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.