CVE-2026-54698

Name of the Vulnerable Software and Affected Versions Hasura versions prior to 2.49.2 Hasura versions prior to 2.45.5

Description A flaw exists where a user can employ a where clause on a table computed field that returns SETOF some table to infer row values. This occurs even when those rows should be filtered based on the row-level permissions of some table. Although the rows cannot be returned directly, string predicates allow values to be brute forced by using the where clause as an oracle, which is a technique used to extract data by observing the application's response to specific queries.

Recommendations Update to version 2.49.2 or later. Update to version 2.45.5 or later.