Hasura Graphql_engine
7 CVEs affecting Hasura Graphql_engine. Latest disclosed: 2026-01-21. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47748 | Critical | 9.8 | 2026-01-21 | Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. A… |
CVE-2022-46792 | High | 8.8 | 2022-12-08 | Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1… |
CVE-2021-47713 | High | 7.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with exces… |
CVE-2023-27588 | High | 7.5 | 2023-03-14 | Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prio… |
CVE-2019-1020015 | High | 7.5 | 2019-07-29 | graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT. |
CVE-2021-47714 | Medium | 5.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attacke… |
CVE-2021-47715 | Medium | 5.3 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_s… |