Vendor
Unauthenticated Administrative API Exposure in Dgraph Zero
1 rule 1 TTP 1 CVEDgraph versions up to 25.3.8 expose an unauthenticated HTTP administrative API on port 6080, allowing remote attackers to perform unauthorized cluster membership operations and cause denial of service.
Unauthenticated Remote Data Replacement in Dgraph Alpha
2 TTPs 1 CVEAn unauthenticated remote attacker can leverage the Dgraph Alpha gRPC interface to clear or replace internal database group stores, potentially leading to unauthorized data modification and privilege escalation.
Dgraph Pre-Auth DQL Injection Vulnerability
1 rule 1 TTPA pre-authentication DQL injection vulnerability in Dgraph's `/mutate` endpoint, when ACL is disabled, allows attackers to exfiltrate the entire database by crafting a malicious `cond` field in an upsert mutation.
Dgraph Unauthenticated Admin Token Disclosure via /debug/vars
3 rules 2 TTPsDgraph versions prior to 25.3.3 expose the admin token via the `/debug/vars` endpoint, allowing unauthenticated attackers to bypass authentication and gain administrative access.
Dgraph Unauthenticated Admin Token Disclosure Vulnerability
2 rules 2 TTPs 1 CVEDgraph versions 25.3.1 and prior expose the admin token via an unauthenticated endpoint, enabling attackers to gain administrative access by reusing the leaked token.
Dgraph Pre-Auth Full Database Exfiltration via DQL Injection
2 rules 6 TTPsA pre-authentication DQL injection vulnerability in Dgraph's default configuration allows attackers to exfiltrate the entire database by crafting malicious JSON mutations to the `/mutate` endpoint, exploiting unsanitized language tags in predicates.