CVE-2023-31135

CVE-2023-31135 describes a brute-force vulnerability in Dgraph's audit logs, affecting all versions prior to v23.0.0. The flaw stems from nonce collisions during encryption, where the reuse of nonces due to predictable log line lengths makes the logs susceptible to decryption. This vulnerability has a CVSS score of 5.5 (Medium), indicating that an attacker with local access to the system storing the logs could potentially compromise the confidentiality of the audit data. While there are no known active exploits, public exploit code, or significant community discussion, users are advised to upgrade to Dgraph v23.0.0 or encrypt existing logs externally as a mitigation.