CVE-2026-54698
Full vulnerability record from the local CVENow database.
Description
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
Severity
MEDIUM
CVSS score
6.0
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-07 22:16:53.500000
Last modified
2026-10-25 20:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-54698",
"sourceIdentifier": "[email protected]",
"published": "2026-07-07T22:16:53.500",
"lastModified": "2026-10-25T20:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5."
},
{
"lang": "es",
"value": "Hasura es un producto de código abierto que proporciona a los usuarios API GraphQL o REST. Antes de las versiones 2.49.2 y 2.45.5, un usuario puede usar una cláusula where en un campo calculado de tabla (que devuelve SETOF some_table) para inferir valores de fila que deberían ser filtrados para su rol basándose en los permisos a nivel de fila de some_table. Si bien dichas filas no pueden ser devueltas directamente, los predicados en cadenas, por ejemplo, permiten que los valores sean forzados por fuerza bruta de manera eficiente con la cláusula where como un oráculo. Este problema está solucionado en las versiones 2.49.2 y 2.45.5."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "hasura",
"product": "graphql-engine",
"versions": [
{
"version": ">= 2.46.0, < 2.49.2",
"status": "affected"
},
{
"version": ">= 2.45.0, < 2.45.5",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-08T13:01:48.684963Z",
"id": "CVE-2026-54698",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.45.0",
"versionEndIncluding": "2.45.5",
"matchCriteriaId": "D7F90732-13F4-4242-9BF8-EFB725084F5D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.46.0",
"versionEndIncluding": "2.49.2",
"matchCriteriaId": "5E56130B-8DD2-4F99-B1A5-2FF887B05A97"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}