Product
Unauthenticated Remote Data Replacement in Dgraph Alpha
2 TTPs 1 CVEAn unauthenticated remote attacker can leverage the Dgraph Alpha gRPC interface to clear or replace internal database group stores, potentially leading to unauthorized data modification and privilege escalation.
Dgraph Pre-Auth DQL Injection Vulnerability
1 rule 1 TTPA pre-authentication DQL injection vulnerability in Dgraph's `/mutate` endpoint, when ACL is disabled, allows attackers to exfiltrate the entire database by crafting a malicious `cond` field in an upsert mutation.
Dgraph Unauthenticated Admin Token Disclosure via /debug/vars
3 rules 2 TTPsDgraph versions prior to 25.3.3 expose the admin token via the `/debug/vars` endpoint, allowing unauthenticated attackers to bypass authentication and gain administrative access.
Dgraph Unauthenticated Admin Token Disclosure Vulnerability
2 rules 2 TTPs 1 CVEDgraph versions 25.3.1 and prior expose the admin token via an unauthenticated endpoint, enabling attackers to gain administrative access by reusing the leaked token.
Dgraph Pre-Auth Full Database Exfiltration via DQL Injection
2 rules 6 TTPsA pre-authentication DQL injection vulnerability in Dgraph's default configuration allows attackers to exfiltrate the entire database by crafting malicious JSON mutations to the `/mutate` endpoint, exploiting unsanitized language tags in predicates.