CVE-2026-54698

Received Received - Intake

Information Disclosure in Hasura GraphQL Engine

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-54698

Affected Vendors & Products

Vendor	Product	Version / Range
hasura	hasura	to 2.45.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Hasura versions prior to 2.49.2 and 2.45.5. It allows a user to use a where clause on a table computed field that returns a set of rows (SETOF some_table) to infer values of rows that should be filtered based on row-level permissions for their role.

Although the rows cannot be returned directly due to permissions, the where clause predicates can be used as an oracle to efficiently brute force and infer these values.

This means an attacker can deduce sensitive data that should have been protected by row-level security.

Impact Analysis

The vulnerability can lead to unauthorized inference of sensitive data that should be protected by row-level permissions.

Attackers can use the where clause as an oracle to brute force and discover values from restricted rows, potentially exposing confidential or sensitive information.

This undermines the intended access controls and can lead to data leakage even if direct access to the rows is not granted.

Mitigation Strategies

To mitigate this vulnerability, upgrade Hasura to version 2.49.2 or 2.45.5 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54698. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70