CVE-2026-34976 Dgraph CVE debrief

Who should care

Dgraph administrators, security teams, and developers using Dgraph in their applications should assess exposure and apply the patch to prevent exploitation. This includes reviewing system logs for suspicious activity, verifying patch application, and ensuring that compensating controls are in place for exposed systems. Security teams should also monitor for potential SSRF attacks and database modifications.

Why it matters

CVE-2026-34976 is a critical vulnerability in Dgraph that allows unauthenticated attackers to overwrite the database, read server-side files, and perform SSRF. Dgraph administrators and security teams should assess exposure and apply the patch to prevent exploitation.

• Potential database overwrite and data loss.
• Possible SSRF attacks leading to unauthorized access.
• Server-side file reading and potential sensitive information disclosure.
• Verification of patch application and vulnerability remediation is required.

Technical summary

The restoreTenant admin mutation in Dgraph is unauthenticated, allowing an attacker to overwrite the entire database, read server-side files, and perform SSRF. The vulnerability is fixed in version 25.3.1. The restoreTenant mutation can be exploited using attacker-controlled backup source URLs, S3/MinIO credentials, encryption key file paths, and Vault credential file paths. This could lead to potential database overwrite, SSRF, and server-side file reading. Dgraph administrators and security teams should assess exposure and apply the patch.

Defensive priority

High

Recommended defensive actions

• Review and apply the vendor's patch (version 25.3.1) to prevent exploitation.
• Restrict access to the restoreTenant admin mutation to authenticated and authorized users.
• Monitor for suspicious activity related to SSRF and database modifications.
• Verify the scope of affected versions and apply the patch accordingly.
• Perform compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD. The vendor has released a fix in version 25.3.1. However, the exact scope of affected versions and potential impact requires verification. The vulnerability allows for potential database overwrite, SSRF, and server-side file reading due to unauthenticated restoreTenant admin mutation. Evidence limits suggest verifying affected deployments, reviewing official advisories, and tracking exceptions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.