CVE-2026-54698: graphql engine from 2.45.0 (inclusive), through 2.45.5 (inclusive), from 2.46.0 (inclusive), through 2.49.2…

Affected technology

graphql engine · from 2.45.0 (inclusive), through 2.45.5 (inclusive)
hasura

graphql engine · from 2.46.0 (inclusive), through 2.49.2 (inclusive)
hasura

graphql-engine · >= 2.46.0, < 2.49.2, >= 2.45.0, < 2.45.5
hasura

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. Vendor/CNA’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none.