GCVE - cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:hasura:graphql_engine:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Hasura (`06d0bbac-ff6d-5740-8bd3-432231a37a86`)
Product	Graphql Engine (`638d8014-b2f8-5df5-9652-9e813bcf30cf`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/hasura/graphql-engine`	purl2cpe	2026-06-01 10:11:06.293317
`pkg:github/hasura/graphql-engine`	purl2cpe	2026-06-01 10:11:06.293319

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-27588`	vulnerable	2026-06-08 05:57:42.088540	Unauthenticated path traversal vulnerability in Hasura GraphQL Engine HIGH (7.5) Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch. Published: 2023-03-14T17:23:10.499Z Updated: 2025-02-25T14:57:42.725Z Open on db.gcve.eu Reference links https://github.com/hasura/graphql-engine/security/advisories/GHSA-c9rw-rw2f-mj4x https://github.com/hasura/graphql-engine/commit/dda54543ee1ecf647ca5d0971b140c3a7b9f4158 https://github.com/hasura/graphql-engine/releases/tag/v1.3.4 https://github.com/hasura/graphql-engine/releases/tag/v2.11.5 https://github.com/hasura/graphql-engine/releases/tag/v2.20.1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-46792`	vulnerable	2026-06-08 05:50:39.435919	Details available Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.) Published: 2022-12-08T00:00:00.000Z Updated: 2025-04-23T14:25:42.452Z Open on db.gcve.eu Reference links https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0/ https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-1020015`	vulnerable	2026-06-08 05:12:21.884751	Details available graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT. Published: 2019-07-29T12:21:40.000Z Updated: 2024-08-05T03:14:16.238Z Open on db.gcve.eu Reference links https://github.com/hasura/graphql-engine/commit/f2f14e727b051e3003ba44b9b63eab8186b291ac	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.