CVE-2026-34976Disclosure(dgraph / dgraph)

Dgraph veritabanında kritik bir güvenlik açığı tespit edildi! CVE-2026-34976 kodlu bu açık, kimlik doğrulamayı atlayarak veri kaybına yol açabilir. Detaylar ve önlemler için haberimize göz atın. Haberin detayı: https://kantan.news/haber/dgraph-veritabaninda-kritik-guvenlik-acigi-kimlik-dogrulama-atlanabiliyor

Hackers can bypass authentication in Dgraph Database (CVE-2026-34976), risking full data exposure. With a CVSS score of 9.8, this flaw is critical. Patch now to prevent unauthorized access. This vulnerability is actively exploited. #CyberSecurity #InfoSec https://t.co/cwMxuMKmlt

🚨 CVE-2026-34976 - critical 🚨 Dgraph <=v25.3.0 - Admin Mutation Missing Authorization > Dgraph <=v25.3.0 contains an authentication bypass caused by missing authorization mi... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-34976 @pdnuclei #NucleiTemplates #cve

Dgraph データベースの脆弱性 CVE-2026-34976：コマンド保護の欠落による SSRF など https://iototsecnews.jp/2026/04/06/critical-dgraph-database-flaw-allowed-attackers-to-bypass-authentication/ この問題の原因は、Dgraph の管理用コマンドにおける認可処理の実装漏れにあります。通常の管理コマンドには、認証などのセキュリティ・チェックが適用されていましたが、restoreTenant という特定のコマンドだけが保護対象から外れていました。このミスにより、未認証の第三者が外部からデータベースを上書きしたり、内部ファイルを読み取ったりできる状態が生じています。この脆弱性 CVE-2026-34976 の CVSS スコアは、最大値である 10.0 と評価されています。 #CVE202634976 #Dgraph #Vulnerability

⚠️ **Vulnerability Alert:** Dgraph Missing Authorization (CVE-2026-34976) + Apache Traffic Server DoS/Request Smuggling 📅 **Timeline:** Disclosure: Not Available; Patch: Not Available 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) | 📈 EPSS: Not Available% 🛠️ **Exploit Maturity:** Not Available 🫨 **Attack Vectors:** - Unauthenticated remote overwrite of Dgraph database leading to integrity/availability loss and potential system takeover - Denial-of-Service against Apache Traffic Server (service availability impact) - HTTP request smuggling against Apache Traffic Server (request manipulation/bypass) 📝 **Summary:** An unauthenticated missing-authorization flaw in Dgraph (CVE-2026-34976, reported CVSS 10.0) can allow remote attackers to overwrite data and potentially achieve full system compromise; separately, Apache Traffic Server issues may enable DoS and HTTP request smuggling. No confirmed active exploitation reported — prioritize patching, exposure restriction, and monitoring. 📈 **Impact Scope:** Dgraph: full confidentiality/integrity/availability compromise of affected deployments if exploited. Apache Traffic Server: service disruption and potential request manipulation; no confirmed active exploitation reported in source articles. 🛡️ **Recommended Actions:** - Apply vendor security updates for Dgraph and Apache Traffic Server when available. - If Dgraph exposed, restrict network access (firewall/ACLs) and isolate suspected hosts. 🪢 **Related Resources:** - https://gbhackers.com/critical-dgraph-database-flaw/ - https://gbhackers.com/apache-traffic-server-flaw-2/ 🏷 **Tags:** #Cybersecurity #Dgraph #ApacheTrafficServer

Unpatched Admin Endpoint Exposes Critical Data Now CVE-2026-34976 exposes an unauthenticated Dgraph admin endpoint (restoreTenant) due to an omitted middleware, score 10.0. Attackers can overwrite DB, probe files, SSRF to internal services, or steal Kubernetes tokens. No patch yet; enforce tight network access and monitor outbound calls, especially to metadata services, until patched. Read more: https://medium.com/@iliasarmenakis/cvss-10-0-no-patch-the-admin-endpoint-is-just-open-cf199202138a?source=rss------cybersecurity-5 Discover the app: https://www.secwiser.com/app #CyberSecurity #InfrastructureSecurity #CloudSecurity #Vulnerability #Kubernetes #DevOps #AWS #Azure #Secwiser

🔍 Today's Top Vulnerabilities 🔴 CVE-2026-34208 | CVSS 10.0 🔴 CVE-2026-34976 | CVSS 10.0 🔴 CVE-2025-54328 | CVSS 10.0 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel

Critical flaw in Dgraph (CVE-2026-34976) allows full auth bypass. CVSS 10.0 No patch yet. Attackers can take over databases remotely. Restrict admin access NOW. 𝐑𝐞𝐚𝐝 𝐅𝐮𝐥𝐥 𝐒𝐭𝐨𝐫𝐲 : https://cybertechnologyinsights.com/ai-security/dgraph-flaw-cve-2026-34976-enables-auth-bypass-attacks/ https://t.co/yD4hrCFRN4

CVE-2026-34976 Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go… https://www.cve.org/CVERecord?id=CVE-2026-34976

[CVE-2026-34976: CRITICAL] Warning: Dgraph prior to 25.3.1 had an unauthenticated vulnerability allowing attackers to overwrite the database and perform SSRF attacks. Update to version 25.3.1 for fix.#cve,CVE-2026-34976,#cybersecurity https://cvefind.com/CVE-2026-34976

🚨 CVE-2026-34976: Dgraph Affected by Pre-Auth Data... Unauthenticated GraphQL database nuking via missing auth middleware - restoreTenant accepts arbitrary URLs for complete... https://zerodaysignal.com/vulnerability/CVE-2026-34976 #netsec #vulnerability #CVE #sysadmin #zeroday

⚠️ **Vulnerability Alert:** Dgraph Authentication Bypass Vulnerability (CVE-2026-34976) 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) 🛠️ **Exploit Maturity:** Not Available 🫨 **Attack Vectors:** - Network (Unauthenticated) 📝 **Summary:** Unauthenticated remote attackers can bypass authentication/authorization in Dgraph to overwrite databases, read sensitive server files, and potentially fully compromise instances. The flaw is exploitable remotely over the network without credentials. 📈 **Impact Scope:** Unauthenticated remote attackers can bypass authentication/authorization in Dgraph, enabling database overwrite, reading of sensitive server files, and potential full compromise of the database instance. 🛡️ **Recommended Actions:** - Restrict network exposure to Dgraph (firewall, VPC, limit access). - Apply vendor patch as soon as it's released and track advisories. - Enforce strong authentication/disable anonymous access; isolate affected instances and rotate credentials. - Take offline backups and prepare restore procedures before remediation. - Monitor logs/network traffic and deploy WAF/access proxies to block anomalous requests. 🪢 **Related Resources:** - https://cybersecuritynews.com/dgraph-database-vulnerability/ - https://nvd.nist.gov/vuln/detail/CVE-2026-34976 🏷 **Tags:** #Cybersecurity #Dgraph #CVE202634976

⚠️ **Vulnerability Alert:** Dgraph Unauthenticated Authentication Bypass (CVE-2026-34976) 📅 **Timeline:** Disclosure: 2026-04-06 — Patch: Not Available 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) | 📈 EPSS: Not Available% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** 25.3.0 and older 🫨 **Attack Vectors:** - Unauthenticated GraphQL administration restoreTenant mutation - Remote fetch of attacker-controlled backup URL (complete DB overwrite) - Local file access via file:// (sensitive file disclosure) - Server-Side Request Forgery (SSRF) to internal services/cloud metadata endpoints 📝 **Summary:** A missing-authorization flaw in Dgraph's GraphQL admin API (restoreTenant) lets unauthenticated attackers trigger administrative restores to overwrite databases, read local files, and perform SSRF. Internet-exposed admin endpoints face catastrophic risk to confidentiality, integrity, and availability. 📈 **Impact Scope:** Internet-exposed Dgraph administration endpoints can be fully compromised: attackers can overwrite databases (availability/integrity loss), read sensitive local files and credentials (confidentiality loss), and pivot via SSRF. Impact is catastrophic for affected deployments. 🛡️ **Recommended Actions:** - Isolate Dgraph admin endpoints from the public internet; restrict access to trusted IPs and monitor/block restoreTenant requests at the network/WAF layer. - Follow/apply the Dgraph security advisory when available, rotate exposed credentials, inspect/restore from known-good offline backups, restrict egress to block SSRF to metadata/internal endpoints, and enable centralized audit logging. 🪢 **Related Resources:** - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw - https://cybersecuritynews.com/dgraph-database-vulnerability/ 🏷 **Tags:** #Cybersecurity #Dgraph #CVE2026-34976

⚠️ **Vulnerability Alert:** Apache Traffic Server (CVE-2025-58136, CVE-2025-65114) and Dgraph Database (CVE-2026-34976) 📅 **Timeline:** Disclosure: 2026-04-06, Patch: 2026-04-06 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) 🆔 **CVE-2025-58136** 🆔 **CVE-2025-65114** 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** Dgraph ≤25.3.0, Apache Traffic Server 9.0.0–9.2.12, Apache Traffic Server 10.0.0–10.1.1 🔧 **Fixed Versions:** Dgraph: pending, ATS 9.x → 9.1.13+, ATS 10.x → 10.1.2+ 🫨 **Attack Vectors:** - Dgraph: unauthenticated access to admin GraphQL (restoreTenant) allowing remote restore from attacker-controlled URL or file:// — SSRF and local file reads possible - ATS (CVE-2025-58136): crafted HTTP POST causing application crash (remote DoS) - ATS (CVE-2025-65114): malformed chunked message handling enabling HTTP request smuggling 📝 **Summary:** Dgraph’s flaw (CVE-2026-34976) allows unauthenticated admin restore, enabling DB overwrite, local file reads, and SSRF — full compromise of confidentiality/integrity/availability. Apache Traffic Server issues permit remote DoS and request smuggling that can poison caches or expose downstream data. 📈 **Impact Scope:** CVE-2026-34976 enables total loss of confidentiality, integrity, and availability (database overwrite, data exposure). ATS issues enable service disruption (DoS) and potential downstream data exposure/cache poisoning. 🛡️ **Recommended Actions:** - Apply ATS updates immediately: upgrade 9.x → 9.1.13+ or 10.x → 10.1.2+; apply Dgraph patch when released - If ATS cannot be patched now, set proxy.config.http.request_buffer_enabled = 0 as a temporary mitigation - Isolate and block public access to Dgraph admin endpoints (e.g., block port 8080) and treat backups as potentially suspect - Monitor logs and outbound requests for suspicious restore attempts, SSRF indicators, or unexpected egress 🪢 **Related Resources:** - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw - https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q 🏷 **Tags:** #Cybersecurity #Dgraph #ApacheTrafficServer

⚠️ **Vulnerability Alert:** Dgraph Authentication Bypass Vulnerability (CVE-2026-34976) 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) | 📈 EPSS: Not Available% 🛠️ **Exploit Maturity:** Not Available 🫨 **Attack Vectors:** - Unauthenticated remote attacker (network) - Authentication/authorization bypass 📝 **Summary:** A critical authentication/authorization implementation flaw in Dgraph allows unauthenticated remote attackers to bypass controls, overwrite entire databases, and read sensitive server files. This can result in total data loss, data exfiltration, and potential full compromise of affected instances. 📈 **Impact Scope:** Unauthenticated attackers can bypass authentication/authorization, overwrite entire databases, read sensitive server files, leading to total data loss, data exfiltration, and potential full compromise of affected Dgraph instances. 🛡️ **Recommended Actions:** - Isolate exposed Dgraph instances from public networks - Block or restrict access to Dgraph service ports via firewall or network ACLs 🪢 **Related Resources:** - https://cybersecuritynews.com/dgraph-database-vulnerability/ 🏷 **Tags:** #Cybersecurity #Dgraph #CVE2026_34976

Critical Dgraph Database Vulnerability Let Attackers Bypass Authentication https://ift.tt/BEVA7vq A maximum-severity vulnerability in Dgraph, a popular open-source graph database. Tracked as CVE-2026-34976, this critical flaw carries a perfect CVSS score of 10.0. It allows u…

BREAKING: Critical Dgraph flaw CVE-2026-34976 (CVSS 10.0) lets unauthenticated attackers overwrite databases, read server files and launch SSRF on all versions, no patch yet. https://threatcluster.io/cluster/critical-dgraph-database-flaw-allowed-attackers-to-bypass-au-c060c18c

⚠️ **Vulnerability Alert:** Dgraph Missing Authorization / Authentication Bypass (CVE-2026-34976) 📅 **Timeline:** Disclosure: 2026-04-06, Patch: N/A 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) | 📈 EPSS: Not Available% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** All Dgraph versions up to v25.3.0 🫨 **Attack Vectors:** - Database overwrite via external backup URL (unauthenticated restore) - Sensitive local file disclosure via crafted restore paths - SSRF to internal services and metadata endpoints - Credential theft (Kubernetes service account tokens, system password files) 📝 **Summary:** A missing-authorization flaw in Dgraph's restoreTenant admin function (CVE-2026-34976) allows remote unauthenticated attackers to trigger privileged restores. Exploitation can overwrite databases, exfiltrate local files, pivot via SSRF, and lead to full data integrity loss or system takeover on affected instances. 📈 **Impact Scope:** Remote, unauthenticated attackers can overwrite data with attacker-controlled backups, leak files, access internal endpoints, and potentially achieve system takeover for deployments running affected versions (<= v25.3.0). 🛡️ **Recommended Actions:** - Immediately remove public exposure of Dgraph admin endpoints and restrict access via firewall/IP allowlists - Monitor and alert on restoreTenant/restore operations; disable or isolate restore endpoints until patched - Rotate credentials/secrets if compromise suspected and validate/implement immutable backups - Audit deployments for unauthorized restores or unexpected data changes; apply official patch when released 🪢 **Related Resources:** - https://github.com/dgraph-io/dgraph/security/advisories/GHSA-p5rh-vmhp-gvcw - https://gbhackers.com/critical-dgraph-database-flaw/ 🏷 **Tags:** #Cybersecurity #Dgraph #CVE202634976

⚠️ **Vulnerability Alert:** Dgraph Authentication Bypass (Missing Authorization) 📅 **Timeline:** Disclosure: N/A; Patch: N/A 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** <= v25.3 🫨 **Attack Vectors:** - Remote unauthenticated HTTP access - Missing authorization checks in the application 📝 **Summary:** Missing authorization in Dgraph (<= v25.3) allows unauthenticated remote attackers to read, modify, or overwrite database contents. Exposed instances can suffer complete data loss and potential full system compromise. 📈 **Impact Scope:** Unauthenticated remote write access to Dgraph databases allowing data overwrite/destruction and potential full system compromise. 🛡️ **Recommended Actions:** - Restrict network access to Dgraph endpoints (firewall/IP allowlist) - Apply vendor patches when available; if not available, isolate the service and implement authentication/proxy controls 🪢 **Related Resources:** - https://cyberpress.org/dgraph-flaw/ - https://gbhackers.com/critical-dgraph-database-flaw/ 🏷 **Tags:** #Cybersecurity #Dgraph #AuthBypass

⚠️ **Vulnerability Alert:** Dgraph Missing Authorization / Authentication Bypass (CVE-2026-34976) 📅 **Timeline:** Disclosure: Not available, Patch: Not available 🆔 **CVE-2026-34976** | 📊 CVSS: 10.0 (Critical 🔴) | 📈 EPSS: Not available% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** Dgraph versions up to v25.3 🫨 **Attack Vectors:** - Remote unauthenticated network access to Dgraph endpoints - Unauthenticated API/management interface abuse leading to data overwrite/destruction 📝 **Summary:** A missing-authorization/authentication vulnerability in Dgraph allows remote unauthenticated attackers to access and modify databases, including overwriting and destructive operations. Successful exploitation can lead to full confidentiality, integrity, and availability compromise and complete system takeover. 📈 **Impact Scope:** Remote unauthenticated attackers can access and modify the database, overwrite contents, and achieve full system compromise (confidentiality, integrity, availability impact). 🛡️ **Recommended Actions:** - Isolate affected instances and block external access immediately (firewall/VPC restrictions). - Apply vendor patches or official mitigations when available; follow upgrade guidance. - Restore from offline known-good backups if data integrity is compromised. - Rotate credentials/secrets and audit logs for suspicious writes, schema changes, or admin actions. - Treat deployments as potentially compromised and perform forensic analysis if exploitation is suspected. 🪢 **Related Resources:** - https://cyberpress.org/dgraph-flaw/ - https://gbhackers.com/critical-dgraph-database-flaw/ 🏷 **Tags:** #Cybersecurity #Dgraph #CVE2026_34976