GO-2026-5529

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5529

Import Source

https://vuln.go.dev/ID/GO-2026-5529.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5529

Aliases

Published

2026-08-11T20:19:48Z

Modified

2026-08-11T20:45:07.544223309Z

Summary

Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

Details

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation.

An unauthenticated remote attacker could use this mutation to trigger a database restore from an arbitrary URL, potentially leading to a complete database overwrite, Server-Side Request Forgery (SSRF), or arbitrary file read on the host system.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5529",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/graphql/admin",
            "symbols": [
                "NewServers"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5529.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.3.1

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25/graphql/admin",
            "symbols": [
                "NewServers"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5529.json"

Go / github.com/hypermodeinc/dgraph/v24

Package

Name: github.com/hypermodeinc/dgraph/v24; View open source insights on deps.dev
Purl: pkg:golang/github.com/hypermodeinc/dgraph/v24

Affected ranges

Type: SEMVER
Events: Introduced

24.0.0

Fixed

24.1.6

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hypermodeinc/dgraph/v24/graphql/admin",
            "symbols": [
                "NewServers"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5529.json"