CVE-2026-54698
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Hasura prior to versions 2.49.2 and 2.45.5 contains a vulnerability that allows a user to use a WHERE clause on a table computed field (returning SETOF some_table) to infer row values that should be filtered based on row-level permissions. Although such rows cannot be returned directly, predicates on strings for instance allow values to be brute forced efficiently using the WHERE clause as an oracle.
Risk Assessment
The risk involves potential bypass of row-level access controls, which could lead to unauthorized disclosure of sensitive data stored in tables.
Recommendation
Immediately upgrade Hasura to version 2.49.2 or 2.45.5, which include the fix for this vulnerability.
Original NVD description (English source)
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.