CVE-2023-31135

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being encrypted. This is problematic because two log lines will often have the same length, so due to these collisions we are reusing the same nonce many times. All audit logs generated by versions of Dgraph <v23.0.0 are affected. Attackers must have access to the system the logs are stored on. Dgraph users should upgrade to v23.0.0. Users unable to upgrade should store existing audit logs in a secure location and for extra security, encrypt using an external tool like `gpg`.

• CWE-326

• https://en.wikipedia.org/wiki/Cryptographic_nonceTechnical Description
• https://github.com/dgraph-io/dgraph/pull/8323Issue Tracking, Patch
• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-92wq-q9pq-gw47Vendor Advisory
• https://en.wikipedia.org/wiki/Cryptographic_nonceTechnical Description
• https://github.com/dgraph-io/dgraph/pull/8323Issue Tracking, Patch
• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-92wq-q9pq-gw47Vendor Advisory

Published

May 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3113An unauthenticated XML external entity injection (XXE) vulne…7.5
• CVE-2023-31130c-ares is an asynchronous resolver library. ares_inet_net_pt…6.4
• CVE-2023-31131Greenplum Database (GPDB) is an open source data warehouse b…9.1
• CVE-2023-31132Cacti is an open source operational monitoring and fault man…7.8
• CVE-2023-31133Ghost is an app for new-media creators with tools to build a…7.5
• CVE-2023-31134Tauri is software for building applications for multi-platfo…5.4
• CVE-2023-31136PostgresNIO is a Swift client for PostgreSQL. Any user of Po…5.9
• CVE-2023-31137MaraDNS is open-source software that implements the Domain N…7.5
• CVE-2023-31138DHIS2 Core contains the service layer and Web API for DHIS2,…6.5
• CVE-2023-31139DHIS2 Core contains the service layer and Web API for DHIS2,…7.5
• CVE-2023-3114Terraform Enterprise since v202207-1 did not properly implem…7.7
• CVE-2023-31140OpenProject is open source project management software. Star…6.5