CVE-2023-31135
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Dgraph is a distributed GraphQL database. Existing audit logs are vulnerable to brute force attacks due to nonce collisions — the first 12 bytes come from a baseIv and the last 4 bytes from the length of the encrypted log line, causing the same nonce to be reused many times. All audit logs generated by Dgraph versions <v23.0.0 are affected.
Risk Assessment
An attacker with access to the system storing the logs can exploit nonce collisions to perform brute force attacks and decrypt audit data. This may lead to disclosure of sensitive information from the logs.
Recommendation
Upgrade Dgraph to v23.0.0. If upgrading is not possible, store existing audit logs in a secure location and additionally encrypt them using an external tool such as gpg.
Other vulnerabilities in Dgraph
See all- CVE-2026-102748Critical
In Dgraph prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval.
- CVE-2026-54061Critical
Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.
- CVE-2026-63637High
Dgraph before version 25.3.8 in maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without proper quoting or validation, allowing injection of DQL operators, disclosure of unintended nodes, or expansion of modification and deletion targets. The issue is fixed in version 25.3.8.
- CVE-2026-44840High
In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.
Original NVD description (English source)
Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being encrypted. This is problematic because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many times. All audit logs generated by versions of Dgraph <v23.0.0 are affected. Attackers must have access to the system the logs are stored on. Dgraph users should upgrade to v23.0.0. Users unable to upgrade should store existing audit logs in a secure location and for extra security, encrypt using an external tool like `gpg`.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS