CVE-2023-27588: Hasura Graphql Engine

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Hasura is an open-source product that provides users GraphQL or REST APIs. A path traversal vulnerability has been discovered within Hasura GraphQL Engine prior to versions 1.3.4, 2.55.1, 2.20.1, and 2.21.0-beta1. Projects running on Hasura Cloud were not vulnerable. Self-hosted Hasura Projects with deployments that are publicly exposed and not protected by a WAF or other HTTP protection layer should be upgraded to version 1.3.4, 2.55.1, 2.20.1, or 2.21.0-beta1 to receive a patch.

Affected products

• Hasura Graphql Engine: before 1.3.4 (fixed in 1.3.4); from 2.0.0, before 2.11.5 (fixed in 2.11.5); from 2.12.0, before 2.20.1 (fixed in 2.20.1)

Published 2023-03-14. Last modified 2026-06-17.