- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 9
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 6 excluded.
Web 1
- https://github.com/dgraph-io/dgraph
Products and areas 13
- Alpha and Zero, the two server binaries, and the gRPC and HTTP surfaces each exposes
- Backup, restore, export and import, including the object storage and filesystem destinations they read and write and the credentials they carry
- Debug and diagnostic surfaces: /debug/pprof and everything under it, /debug/vars, health and state endpoints, and metrics
- Inter-node TLS configuration, the mutual TLS paths and what a node accepts when TLS is not configured
- Multi-tenancy through namespaces, including every operation that takes a namespace argument or infers one from a token
- Raft membership, group assignment and the trust an Alpha or Zero extends to a peer joining the cluster
- Ratel, the bundled administration UI, and the requests it makes on an operator's behalf
- The ACL subsystem: users, groups, predicate-level permissions, the admin token and the HMAC secret behind it
- The /admin endpoint and every mutation reachable through it, including backup, restore, restoreTenant, export, drop and schema alteration
- The Badger storage layer as Dgraph drives it, along with the on-disk state and encryption-at-rest handling
- The DQL parser and executor in full, covering filters, functions, regular expressions and variable blocks
- The /graphql endpoint, the GraphQL schema handling, and the query rewriter that lowers GraphQL into DQL
- The policy asks for any issue or vulnerability through GitHub Security Advisories rather than a public issue, and gives [email protected] as an alternative channel. It names no assets and carves nothing out, so the whole Dgraph tree is a fair report
Out of scope (6)
- A cluster deliberately deployed without ACLs enabled and with admin endpoints on a public interface, where the finding is the deployment decision
- Anything already covered by a published advisory, given how much of this surface was rewritten during 2026
- Badger and other upstream dependency defects, unless Dgraph's own use of them is what makes the issue reachable
- Client libraries maintained in separate repositories, where the defect is in the binding rather than the server
- Findings filed as a public GitHub issue, which the policy explicitly redirects away from
- Resource exhaustion from an expensive traversal or a large mutation, which is a capacity question
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub Security Advisories on the Dgraph repository, or by email to the address on the policy page . The policy names both and tells you not to open a public issue instead
-
State whether the finding needs credentials.
-
Name the affected binary: Alpha, Zero or the Ratel UI, and say whether ACLs were enabled and whether the cluster was multi-tenant
-
Include the DQL or GraphQL that reproduces it, plus the exact admin or debug endpoint used and the port it was reached on
Not accepted
-
Findings filed as a public GitHub issue
-
Badger and other upstream dependency defects
-
Resource exhaustion from an expensive traversal or a large mutation
-
Anything already covered by a published advisory
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
Sorona credits this project with 9 CVEs, 8 of them recent. The individual records appear here after the next sync.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 8 Last 12 months 9 Lifetime Missing authentication 40 % Credential and token disclosure 25 % Query injection 20 % SSRF and file read 15 % Latest advisories Loading the feed Overview Dgraph is a distributed graph database with a native GraphQL interface, now maintained under Hypermode and Istari Digital, and it runs as a cluster of Alpha and Zero nodes holding an entire knowledge graph in one place. CVE-2026-34976 is the reference point: a missing authorization check on restoreTenant gave a pre-authentication database overwrite along with server-side request forgery and file read. Six of the eight advisories published in the last twelve months are critical and most need no credentials at all, which is the strongest severity-per-report record in this study. None of those reporters were paid. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy asks for any issue or vulnerability through GitHub Security Advisories rather than a public issue, and gives [email protected] as an alternative channel. It names no assets and carves nothing out, so the whole Dgraph tree is a fair report Alpha and Zero, the two server binaries, and the gRPC and HTTP surfaces each exposes The /admin endpoint and every mutation reachable through it, including backup, restore, restoreTenant , export, drop and schema alteration The /graphql endpoint, the GraphQL schema handling, and the query rewriter that lowers GraphQL into DQL The DQL parser and executor in full, covering filters, functions, regular expressions and variable blocks Debug and diagnostic surfaces: /debug/pprof and everything under it, /debug/vars , health and state endpoints, and metrics The ACL subsystem: users, groups, predicate-level permissions, the admin token and the HMAC secret behind it Multi-tenancy through namespaces, including every operation that takes a namespace argument or infers one from a token Backup, restore, export and import, including the object storage and filesystem destinations they read and write and the credentials they carry Raft membership, group assignment and the trust an Alpha or Zero extends to a peer joining the cluster The Badger storage layer as Dgraph drives it, along with the on-disk state and encryption-at-rest handling Inter-node TLS configuration, the mutual TLS paths and what a node accepts when TLS is not configured Ratel, the bundled administration UI, and the requests it makes on an operator's behalf Out of scope Findings filed as a public GitHub issue, which the policy explicitly redirects away from Badger and other upstream dependency defects, unless Dgraph's own use of them is what makes the issue reachable A cluster deliberately deployed without ACLs enabled and with admin endpoints on a public interface, where the finding is the deployment decision Client libraries maintained in separate repositories, where the defect is in the binding rather than the server Resource exhaustion from an expensive traversal or a large mutation, which is a capacity question Anything already covered by a published advisory, given how much of this surface was rewritten during 2026 Most-valued findings Unauthenticated administrative operations, the class that defines this target. CVE-2026-54061 let an external snapshot import replace Alpha group stores, and CVE-2026-34976 reached a pre-authentication database overwrite through a missing authorization check on restoreTenant Anything that discloses the admin token or another credential. CVE-2026-40173 leaked it through /debug/pprof/cmdline and CVE-2026-41492 turned the same disclosure into a full authentication bypass, so every debug, metrics and state endpoint is worth walking DQL injection through the GraphQL rewriter, where a caller-supplied value becomes query syntax. CVE-2026-63637 did it through an unvalidated regular expression filter and CVE-2026-44840 through checkUserPassword Server-side request forgery and arbitrary file read out of the backup and restore paths, which take a caller-supplied location and fetch it with the server's own identity Cross-namespace access on a multi-tenant cluster, where a token or an operation reaches data belonging to another namespace ACL evaluation defects where a predicate permission grants more than it was written to grant, or where a group membership is trusted without being checked Cluster trust defects: an unauthenticated node joining a Raft group, or an Alpha accepting internal RPC that should require cluster credentials Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub Security Advisories on the Dgraph repository, or by email to [email protected] . The policy names both and tells you not to open a public issue instead The repository has moved between the dgraph-io and hypermodeinc names and both resolve to the same project, so file wherever GitHub lands you and mention the commit you tested State whether the finding needs credentials. Four of the six criticals in the last year needed none, so a pre-authentication report is the strongest thing you can bring here Name the affected binary: Alpha, Zero or the Ratel UI, and say whether ACLs were enabled and whether the cluster was multi-tenant Include the DQL or GraphQL that reproduces it, plus the exact admin or debug endpoint used and the port it was reached on There is no reward language in the policy and no bounty page. Nothing pays for this report Disclosure Coordinated through the GitHub advisory pipeline, which the maintainers run at pace: nine advisories have been published and eight of them landed in the last twelve months, each with a CVE and a fixed release. No published policy sets an embargo length, so agree it in the advisory thread. Given how many of the recent findings are unauthenticated and critical, expect the maintainers to want a fixed release out before any detail is public. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability