CVE-2026-34976 — Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the…
Image via opengraph.githubassets.com
🚨 CVE-2026-34976 Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it completely unauthenticated. Unlike the similar restore mutation which requires Guardian-of-Galaxy authe
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
- New tool or resource available — evaluate for your security workflow.
- Phishing or social engineering activity — brief your users and SOC team.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Web Application Exploitation Attempt — CVE-2026-34976
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-34976 | Auth Bypass | Dgraph prior to 25.3.1, restoreTenant admin mutation in admin.go is missing authorization middleware, allowing unauthenticated access. |
| CVE-2026-34976 | Path Traversal | Dgraph prior to 25.3.1, restoreTenant admin mutation accepts attacker-controlled backup source URLs including file:// for local filesystem access. |
| CVE-2026-34976 | SSRF | Dgraph prior to 25.3.1, restoreTenant admin mutation accepts attacker-controlled backup source URLs, S3/MinIO credentials, encryption key file paths, and Vault credential file paths. |
| CVE-2026-34976 | Information Disclosure | Dgraph prior to 25.3.1, restoreTenant admin mutation allows reading server-side files via file:// URLs. |
| CVE-2026-34976 | Code Injection | Dgraph prior to 25.3.1, restoreTenant admin mutation allows overwriting the entire database by accepting attacker-controlled backup source URLs. |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 07, 2026 at 20:26 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Daily Security Digest — 2026-05-22
13 vulnerability disclosures (5 Critical, 8 High) and 14 curated intelligence stories from 6 sources.
Huawei Router Flaw Triggered Telecom Blackout, SecurityWeek Reports
SecurityWeek reports on a critical flaw in Huawei routers that led to a significant telecom blackout. While details are sparse, the incident underscores the inherent...
Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities
Ubiquiti has rolled out critical security updates addressing three maximum severity vulnerabilities in UniFi OS. BleepingComputer reports these flaws, tracked as CVE-2023-48092, CVE-2023-48093, and CVE-2023-48094,...