CVE-2026-54698

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hasura:graphql_engine::::::::
	cpe:2.3:a:hasura:graphql_engine::::::::

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Hasura es un producto de código abierto que proporciona a los usuarios API GraphQL o REST. Antes de las versiones 2.49.2 y 2.45.5, un usuario puede usar una cláusula where en un campo calculado de tabla (que devuelve SETOF some_table) para inferir valores de fila que deberían ser filtrados para su rol basándose en los permisos a nivel de fila de some_table. Si bien dichas filas no pueden ser devueltas directamente, los predicados en cadenas, por ejemplo, permiten que los valores sean forzados por fuerza bruta de manera eficiente con la cláusula where como un oráculo. Este problema está solucionado en las versiones 2.49.2 y 2.45.5.

Information

Published : 2026-07-07 22:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-54698

Mitre link : CVE-2026-54698

CVE.ORG link : CVE-2026-54698

JSON object : View

Products Affected

hasura

graphql_engine

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-54698", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54698", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T13:01:48.684963Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "hasura", "product": "graphql-engine", "versions": [{"status": "affected", "version": ">= 2.46.0, < 2.49.2"}, {"status": "affected", "version": ">= 2.45.0, < 2.45.5"}]}]}], "published": "2026-07-07T22:16:53.500", "references": [{"url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5."}, {"lang": "es", "value": "Hasura es un producto de c\u00f3digo abierto que proporciona a los usuarios API GraphQL o REST. Antes de las versiones 2.49.2 y 2.45.5, un usuario puede usar una cl\u00e1usula where en un campo calculado de tabla (que devuelve SETOF some_table) para inferir valores de fila que deber\u00edan ser filtrados para su rol bas\u00e1ndose en los permisos a nivel de fila de some_table. Si bien dichas filas no pueden ser devueltas directamente, los predicados en cadenas, por ejemplo, permiten que los valores sean forzados por fuerza bruta de manera eficiente con la cl\u00e1usula where como un or\u00e1culo. Este problema est\u00e1 solucionado en las versiones 2.49.2 y 2.45.5."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7F90732-13F4-4242-9BF8-EFB725084F5D", "versionEndIncluding": "2.45.5", "versionStartIncluding": "2.45.0"}, {"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E56130B-8DD2-4F99-B1A5-2FF887B05A97", "versionEndIncluding": "2.49.2", "versionStartIncluding": "2.46.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}