Hasura

8 CVEs across 4 Hasura products. Browse Hasura vulnerabilities, severities, and proof-of-concept exploits.

Hasura products with known CVEs

Product	CVEs
Graphql Engine	7
Hasura Graphql	3
Graphql-Engine	2
Graphql	1

Hasura CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2026-54698`			2026-07-07	Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field…
`CVE-2021-47748`	Critical	`9.8`	2026-01-21	Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. A…
`CVE-2021-47715`	Medium	`5.3`	2025-12-22	Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_s…
`CVE-2021-47714`	Medium	`5.5`	2025-12-22	Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attacke…
`CVE-2021-47713`	High	`7.5`	2025-12-22	Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with exces…
`CVE-2023-27588`	High	`7.5`	2023-03-14	Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prio…
`CVE-2022-46792`	High	`8.8`	2022-12-08	Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1…
`CVE-2019-1020015`	High	`7.5`	2019-07-29	graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT.