# CVE-2026-34976: GO-2026-5529 - Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

Source: https://junglewise.ai/threats/cve-2026-34976-dgraph-pre-auth-database-overwrite-ssrf-file-read-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06  
License: CC BY 4.0 with a link back

CVE-2026-34976 · Severity: critical · CVSS 10 · Published 2026-04-06

Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authentication, restoreTenant executes with zero middleware. This mutation accepts attacker-controlled backup source URLs (including file:// for local filesystem access), S3/MinIO credentials, encryption key file paths, and Vault credential file paths. An unauthenticated attacker can overwrite the entire database, read server-side files, and perform SSRF. This vulnerability is fixed in 25.3.1.

Technologies: [Dgraph](https://junglewise.ai/threats/technologies/dgraph-dgraph), [github.com/dgraph-io/dgraph (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph), [github.com/dgraph-io/dgraph/v24 (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph-v24), [github.com/dgraph-io/dgraph/v25 (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph-v25), [github.com/hypermodeinc/dgraph/v24 (Go)](https://junglewise.ai/threats/technologies/github-com-hypermodeinc-dgraph-v24). Vendors: [Dgraph](https://junglewise.ai/threats/vendors/dgraph), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-34976 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34976 being exploited in the wild.

**How severe is CVE-2026-34976?** Critical severity, with a CVSS score of 10, published 6 April 2026.

**Which products and versions are affected?** github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8; github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.0.5; github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.1; github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=24.0.0,fixed=24.1.6.

**Is there a fix for CVE-2026-34976?** Yes. github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.1 or later; github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-34976?** Check whether you run Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.1 or later

  ```sh
  go get github.com/dgraph-io/dgraph/v25@v25.3.1
  ```

- github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.6 or later

  ```sh
  go get github.com/hypermodeinc/dgraph/v24@v24.1.6
  ```


## Affected products

- Dgraph
- github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8
- github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.0.5
- github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.1
- github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=24.0.0,fixed=24.1.6

## Identifiers

- CVE-2026-34976
- GHSA-p5rh-vmhp-gvcw
- GO-2026-5529

## Related threats

- [Dgraph Zero unauthenticated HTTP admin denial of service](https://junglewise.ai/threats/cve-2026-102748-dgraph-zero-unauthenticated-http-admin-removenode-denial-of)
- [Dgraph Alpha missing authentication for external snapshot import](https://junglewise.ai/threats/cve-2026-54061-dgraph-alpha-missing-authentication-for-external-snapshot-import)
- [Dgraph DQL injection in checkUserPassword GraphQL query](https://junglewise.ai/threats/cve-2026-44840-dgraph-dql-injection-in-checkuserpassword-graphql-query)
- [GO-2026-5675 - Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41492-dgraph-unauthenticated-admin-token-disclosure-leading-to)
- [GO-2026-5749 - DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41328-dgraph-pre-auth-full-database-exfiltration-via-dql-injection-in)