CVE-2026-54698

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54698
Aliases
  • GHSA-r27x-gc74-qmxh
Published
2026-07-07T21:29:23.595Z
Modified
2026-07-15T01:49:19.103659548Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Hasura: Row-level authorization bypass on table computed fields
Details

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF sometable) to infer row values that ought to be filtered for their role based on sometable's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54698.json"
}
References

Affected packages

Git / github.com/hasura/graphql-engine

Affected ranges

Type
GIT
Repo
https://github.com/hasura/graphql-engine
Events
Introduced
9333360aaf5f46739d05c22629764dbfb89bb40b
Fixed
cf95b621beb79033455d7fdc163968aa9ba894c7
Introduced
bfb38caee8730381e9f03344acc844a5eb0217cb
Fixed
d5d0a7017b198596cae9b1b330f76e3375ba885d
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.46.0"
        },
        {
            "fixed": "2.49.2"
        },
        {
            "introduced": "2.45.0"
        },
        {
            "fixed": "2.45.5"
        }
    ]
}

Affected versions

cli/v2.*
cli/v2.45.0
cli/v2.45.1
cli/v2.45.2
cli/v2.45.3
v2.*
v2.45.0
v2.45.1
v2.45.2
v2.45.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54698.json"