[Security Advisory] Hasura GraphQL Engine — High-severity security fix available, please upgrade

[Hasura Security Announcements]

Hello,

We are writing to notify you of a high-severity security vulnerability in Hasura GraphQL Engine (HGE) that has been fixed in the releases listed below. We strongly urge all self-hosted users to upgrade to a patched version as soon as possible.

Severity: High (CVSS 3.1 base score 7.7) Affected component: Hasura GraphQL Engine (Postgres / Citus backends) Impact: Under certain permission configurations, a low-privileged role could read data that should have been protected by row-level permissions. This is a confidentiality issue only — no data modification is involved. Advisory: GHSA-r27x-gc74-qmxh — https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh CVE: Reservation in progress; the identifier will be included when full details are published.

Patched versions — please upgrade to at least:

• v2.49.2 (latest stable)
• v2.45.5 (v2.45 LTS line)

What you should do now:

1. Upgrade your HGE deployment to one of the patched versions above.

(Hasura-managed / Cloud deployments have already been patched — no action is required for those.)

Disclosure timeline: In line with coordinated-disclosure best practices, we are withholding the technical details of this vulnerability for 7 days (until approximately July 1, 2026) to give self-hosted users time to upgrade. After that window we will publish the full advisory, including the CVE identifier and a description of the issue, via the GitHub Security Advisory linked above on hasura/graphql-engine.

We thank the external security researcher who responsibly reported this issue.

If you have any questions, contact us at sup...@hasura.io.

Regards,
The Hasura Security Team

[Hasura Security Announcements]

Hello,

Following our advance notice of June 29, 2026, we are now publishing the full technical details of the high-severity security vulnerability in Hasura GraphQL Engine (HGE) that was fixed in v2.49.2 and v2.45.5.

Summary

Advisory: GHSA-r27x-gc74-qmxh https://github.com/hasura/graphql-engine/security/advisories/GHSA-r27x-gc74-qmxh

CVE: CVE-2026-54698

Severity: High (CVSS 3.1 base score 7.7, CWE-863)

Affected versions: All HGE v2.x releases prior to v2.49.2 (latest stable) and v2.45.5 (v2.45 LTS line). Specifically confirmed affected: v2.45.3, v2.49.0, v2.49.1.

Technical Details

A computed field that returns SETOF some_table (a table-returning computed field) can be used in a where clause boolean expression (*_bool_exp) on the defining table. When HGE generates the EXISTS(...) subquery for this boolean expression, it omits the row-level select permission filter that would normally be applied to some_table.

This means an authenticated user with access to the defining table can use the computed field in a where filter as a boolean oracle to infer the existence and values of rows in some_table that their role should not have access to. While the rows themselves cannot be returned directly, like predicates on string columns, for example, allow values to be brute-forced efficiently.

Impact: Confidentiality only — an authenticated low-privileged role can read data protected by row-level permissions. No data modification or availability impact.

Affected Configuration

The vulnerability is present only when all of the following are true:

1. A computed field is defined on a table that returns SETOF another table (a table-returning computed field, not a scalar-returning one).
2. The returned table has row-level select permissions configured (non-trivial select permission with a row filter / check expression).
3. The computed field's function takes only the table-row argument (no extra scalar arguments) — this makes it eligible for inclusion in the table's *_bool_exp.

Deployments with no computed fields, or only scalar-returning computed fields, are not affected.

Patched Versions

• v2.49.2 (latest stable, released June 11, 2026)
• v2.45.5 (v2.45 LTS line, released June 12, 2026)

The fix (PR #11572) applies the returned table's row-level select filters to the computed-field boolean-expression path, matching the behavior already present in relationship and aggregation predicate paths.

Hasura Cloud / managed deployments have already been patched — no action required.

Workaround (if you cannot upgrade immediately)

Untrack the affected computed field from your HGE metadata:

# Via Metadata API { "type": "pg_untrack_table", "args": { "source": "<your_source>", "table": {"schema": "<schema>", "name": "<table_with_computed_field>"}, "computed_fields": ["<computed_field_name>"] } }

Or remove the computed field definition from your metadata and re-apply.

Credit

We thank @cipher-creator (https://github.com/cipher-creator) who responsibly reported this issue.

If you have any questions, contact us at sup...@hasura.io.

Regards,
The Hasura Security Team