EUVD-2026-42118Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible oracle requiring authenticated low-privilege role and iterative query probing (AC:H); pure confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.
AnalysisAI
Row-level authorization bypass in Hasura GraphQL Engine prior to versions 2.49.2 and 2.45.5 permits low-privileged authenticated users to infer the contents of rows their role's permissions should suppress. By submitting crafted where-clause predicates against table computed fields returning SETOF results, an attacker exploits the query response as a boolean oracle - iteratively reconstructing protected column values through binary-search-style probing without ever directly retrieving the restricted rows. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 6.0 with VC:H reflects meaningful confidentiality exposure specifically in deployments relying on row-level security as a data boundary.
Technical ContextAI
Hasura GraphQL Engine (CPE: cpe:2.3:a:hasura:graphql-engine:*:*:*:*:*:*:*:*) is an open-source API layer that auto-generates GraphQL and REST APIs over databases, enforcing role-based row-level permissions to partition data visibility. The flaw resides in how Hasura evaluates where-clause predicates on table computed fields - PostgreSQL-backed functions returning SETOF (a set of rows from another table). When a predicate is applied to such a field, Hasura evaluates the predicate condition before applying row-level permission filters, making the query's non-empty versus empty response a distinguishable oracle signal even though the underlying protected rows are never returned in the payload. This is classified as CWE-863 (Incorrect Authorization): the root cause is a logical sequencing flaw in permission enforcement, not a memory safety or injection vulnerability. The oracle technique mirrors classical blind SQL injection in structure - observable differences in API behavior allow systematic reconstruction of protected data values.
RemediationAI
Upgrade Hasura GraphQL Engine to version 2.49.2 or later (v2.49 branch) or to 2.45.5 or later (v2.45 branch) - these are the vendor-confirmed fixed releases per GitHub Security Advisory GHSA-r27x-gc74-qmxh at https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh. If an immediate upgrade is not operationally feasible, consider disabling or restricting table computed fields that return SETOF results specifically for roles where row-level permissions are enforced - note this may break application features that rely on those computed fields and should be coordinated with application owners. As a detective control, audit GraphQL API access logs for anomalous patterns of repeated where-clause queries targeting the same computed field with varying predicate values, which may indicate active oracle probing. No network-layer control (WAF, rate limiting) fully substitutes for the patch, as the flaw is in Hasura's internal authorization evaluation sequence.
More in Graphql Engine
View allHasura GraphQL 1.3.3 has a remote code execution vulnerability allowing attackers to execute arbitrary shell commands th
Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. Rat
Hasura is an open-source product that provides users GraphQL or REST APIs. Rated high severity (CVSS 7.5), this vulnerab
graphql-engine (aka Hasura GraphQL Engine) before 1.0.0-beta.3 mishandles the audience check while verifying JWT. Rated
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today