github.com/dgraph-io/dgraph (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/dgraph-io/dgraph, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2026-34976 — CVSS 10.0 (critical): Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization…
• CVE-2026-41492 — CVSS 9.8 (critical): Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the…
• CVE-2026-40173 — CVSS 9.4 (critical): Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure…
• CVE-2026-41327 — CVSS 9.1 (critical): Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an…
• CVE-2026-41328 — CVSS 9.1 (critical): Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an…
• CVE-2023-31135 — CVSS 3.3 (low): Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce…