CVE-2026-54698: Hasura GraphQL Information Disclosure Flaw

CVE-2026-54698 Overview

CVE-2026-54698 is an authorization flaw in Hasura, an open-source engine that exposes GraphQL and REST APIs over relational data. Versions prior to 2.49.2 and 2.45.5 allow an authenticated user to infer row values that row-level permissions should hide. The attacker abuses a where clause on a table computed field returning SETOF some_table. While the filtered rows are not returned directly, predicates like _like on string columns turn the where clause into a boolean oracle. This enables efficient brute-force extraction of protected data one character at a time. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users with any role can bypass row-level permissions and exfiltrate sensitive column values from tables they should not read.

Affected Products

Hasura GraphQL Engine versions prior to 2.49.2 (2.49.x branch)
Hasura GraphQL Engine versions prior to 2.45.5 (2.45.x LTS branch)
GraphQL APIs deployed with computed fields returning SETOF <table>

Discovery Timeline

2026-07-07 - CVE-2026-54698 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54698

Vulnerability Analysis

Hasura enforces role-based row-level permissions on tables through select_permissions filters. These filters restrict which rows a role can read. The vulnerability breaks that guarantee when a table exposes a computed field whose PostgreSQL function returns SETOF <table>.

When a client queries such a computed field, Hasura permits a where clause to filter the set-returning function's output. The permission check gates the returned rows, but the SQL predicate itself executes over unfiltered data. The server-side response signals whether the predicate matched, even when no row is returned to the client. This turns the where clause into a boolean oracle against protected values.

Root Cause

The root cause is a scope mismatch between authorization enforcement and predicate evaluation on computed field results. Row-level permissions apply to the final projection but not to the intermediate filter expression on the SETOF computed field. Consequently, the engine leaks side-channel information about rows the caller is not authorized to see.

Attack Vector

An authenticated user with a low-privilege role submits GraphQL queries that call the computed field and attach where predicates such as _like, _ilike, _gt, or _lt on protected columns. Observable differences in response, including field presence, row count, or timing, reveal whether the predicate matched. By iterating character-class or range predicates, the attacker brute-forces column values such as email addresses, tokens, or password hashes. The attack requires network access to the GraphQL endpoint and a valid session for any role that can invoke the computed field. See the Hasura GitHub Security Advisory GHSA-r27x-gc74-qmxh for further technical detail.

Detection Methods for CVE-2026-54698

Indicators of Compromise

High-volume GraphQL queries from a single session targeting the same computed field with iterative _like, _ilike, or comparison predicates
Query patterns that vary a single character or range boundary across sequential requests against SETOF-returning computed fields
Elevated rates of GraphQL requests returning empty result sets from a low-privilege role
Unusual query complexity or request frequency against Hasura endpoints from non-service accounts

Detection Strategies

Enable Hasura query logs and inspect predicates applied to computed field arguments for wildcard brute-force patterns
Correlate authenticated GraphQL sessions with response-size and response-time distributions to identify oracle-style probing
Alert on repeated queries invoking the same computed field with structurally similar where clauses and incrementing literals

Monitoring Recommendations

Forward Hasura http-log and query-log streams to a centralized SIEM for retention and correlation
Track per-role query rates against tables with defined select_permissions and baseline normal usage
Monitor upstream PostgreSQL for repeated execution of the same set-returning function with rotating filter arguments

How to Mitigate CVE-2026-54698

Immediate Actions Required

Upgrade Hasura GraphQL Engine to 2.49.2 on the 2.49 branch or 2.45.5 on the 2.45 LTS branch
Audit metadata for computed fields that return SETOF <table> and review the row-level permissions on the underlying tables
Rotate any credentials, tokens, or secrets stored in columns that were reachable through vulnerable computed fields
Restrict low-privilege roles from invoking sensitive computed fields until patching is complete

Patch Information

Hasura released fixed builds in versions 2.49.2 and 2.45.5. The patches close the oracle by ensuring where predicates on computed field results respect the same row-level authorization as direct table selection. Refer to the Hasura Security Advisory GHSA-r27x-gc74-qmxh for release notes and upgrade guidance.

Workarounds

Remove or disable computed fields returning SETOF <table> from the Hasura metadata until the upgrade is applied
Revoke select permissions for untrusted roles on tables exposed through affected computed fields
Place a GraphQL-aware reverse proxy or WAF in front of Hasura to rate-limit and pattern-match brute-force where predicates

bash

# Example: apply Hasura metadata change to drop a vulnerable computed field
hasura metadata apply --project ./hasura-project

# Verify running Hasura version after upgrade
curl -s https://hasura.example.com/v1/version