CVE-2026-54698: 
Hasura vulnerability analysis and mitigation

CVE-2026-54698 is a row-level authorization bypass vulnerability in Hasura's open-source GraphQL engine (graphql-engine) that allows authenticated users to infer protected row values via crafted where clause predicates on table computed fields. Published on July 7, 2026, it affects versions >= 2.45.0 and < 2.45.5, as well as >= 2.46.0 and < 2.49.2. The vulnerability was reported by an external researcher (Cipher / Causal Security) and disclosed via GitHub Security Advisory GHSA-r27x-gc74-qmxh. It carries a CVSS v4.0 base score of 6.0 (Medium) and a CVSS 3.1 base score of 7.7 (High) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): Hasura's GraphQL engine fails to apply row-level select filters when evaluating boolean expressions on table computed fields that return SETOF some_table. While the engine correctly enforces row-level permissions on relationship and aggregation predicate paths, this enforcement was absent on the computed-field boolean-expression path. An authenticated attacker with low privileges can craft where clause predicates against such computed fields to use the engine as an oracle — iteratively testing string predicates (e.g., prefix matching) to brute-force infer the values of rows they are not authorized to read directly. No public proof-of-concept code has been identified at this time (GitHub Advisory).

Exploitation results in unauthorized disclosure of data protected by row-level permissions — the impact is limited to confidentiality, with no integrity or availability consequences. An attacker can systematically infer sensitive field values (e.g., secrets, PII, tokens stored in string columns) from rows their role should not be able to access, by using the computed field where clause as a side-channel oracle. The scope is limited to deployments that use table computed fields returning SETOF on tables with row-level permissions configured (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.0017 (0.17%), indicating a low probability of exploitation in the near term. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The vulnerability requires low-privilege authenticated access and high attack complexity, limiting opportunistic exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Confirm the Hasura GraphQL engine instance is running a vulnerable version (>= 2.45.0 and < 2.45.5, or >= 2.46.0 and < 2.49.2) and that it exposes table computed fields returning SETOF some_table with row-level permissions configured on the returned table.
2. Authenticate: Obtain a valid low-privilege user session or API key that has access to query the computed field but is restricted from viewing certain rows via row-level permissions.
3. Craft oracle query: Submit a GraphQL query using a where clause on the computed field with a string predicate (e.g., _like, _eq, _gt) targeting a sensitive column of the returned table type — e.g., where: { computed_field: { secret_column: { _like: "A%" } } }.
4. Observe response: If the query returns results (or a non-empty count), the predicate matched a restricted row, confirming the value begins with the tested prefix.
5. Brute-force inference: Iteratively narrow the predicate (binary search or character-by-character enumeration) to reconstruct the full value of the protected field, effectively bypassing row-level authorization (GitHub Advisory).

• Logs: Hasura query logs showing repeated GraphQL queries targeting the same computed field with incrementally varying where clause string predicates (e.g., _like: "A%", _like: "B%") from a single user or session — indicative of automated enumeration.
• Network: High-frequency GraphQL POST requests to the /v1/graphql endpoint from a single source IP, with query bodies referencing a specific computed field and systematically changing filter values.
• Behavioral: A single authenticated role issuing an unusually large number of queries against a computed field that returns restricted table data, especially with string comparison operators (_like, _eq, _gt, _lt) on sensitive columns.

Hasura has released patched versions v2.49.2 (latest stable, released June 11, 2026) and v2.45.5 (v2.45 LTS line, released June 12, 2026), both of which apply the returned table's row-level select filters to the computed-field boolean-expression path. All users utilizing table computed fields on tables with row-level permissions should upgrade immediately. For deployments that cannot upgrade immediately, the recommended workaround is to untrack the affected computed field (the SETOF-table-returning computed field) from the Hasura metadata to eliminate the attack surface (GitHub Advisory).

The vulnerability was responsibly disclosed by an external security researcher identified as Cipher from Causal Security, and Hasura acknowledged and thanked them in the advisory. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).