CVE-2026-34976

The restoreTenant mutation was not included in the authorization middleware configuration (admin.go file), making it completely devoid of any authentication mechanism — in contrast to the similar restore mutation, which requires Guardian-of-Galaxy level authentication. An attacker can pass backup source URLs controlled by themselves to the mutation, including file:// schemes enabling access to the local file system, S3/MinIO credentials, encryption key file paths, and Vault credential file paths. The request can be sent without any authorization headers directly to the administrative interface.

An unauthenticated attacker can completely overwrite the database, read arbitrary files on the server side (including encryption keys and configuration files), and perform SSRF attacks on internal network infrastructure. In practice, this results in complete loss of confidentiality, integrity, and availability of data.

Dgraph should be updated to version 25.3.1, where the vulnerability has been fixed. Until the update is applied, it is recommended to restrict network access to the Dgraph administrative interface only to trusted hosts using a firewall or network rules.

Dgraph in versions prior to 25.3.1