CVE-2026-34976

CVE-2026-34976 is a critical authentication bypass vulnerability affecting Dgraph, an open source distributed GraphQL database, in versions prior to 25.3.1. The restoreTenant admin mutation lacks required authorization middleware configuration, allowing completely unauthenticated access to a function that should be restricted. This oversight enables attackers to leverage the mutation's acceptance of attacker-controlled parameters including backup source URLs, cloud credentials, encryption keys, and Vault credential file paths. The vulnerability carries a perfect CVSS 3.1 score of 10.0 CRITICAL with a network attack vector, low complexity, and no privilege or user interaction requirements. Exploitation results in complete database compromise through overwrite capability, unauthorized file disclosure via local filesystem access, and server-side request forgery attacks. The impact spans confidentiality, integrity, and availability across connected systems. There is no evidence of active exploitation at this time, as the vulnerability is not included on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security hotlists. While the EPSS score of 0.00095 is relatively low, this likely reflects recency rather than difficulty of exploitation, as the attack requires minimal sophistication. Administrators should prioritize upgrading to version 25.3.1 immediately to eliminate the authentication bypass.