Hasura GraphQL Engine v2.45.8 released with critical MSSQL data‑leak fix and security updates

by

Hasura announced the v2.45.8 patch for its GraphQL Engine on August 5 2026. The release focuses on security hardening and performance tweaks, especially for the Microsoft SQL Server (MSSQL) backend.

Key server‑side changes

  • Critical MSSQL bug fix – A vulnerability that could let an authenticated user view data they were not authorized for has been patched. The vendor urges all MSSQL users to upgrade immediately. (vendor claim)
  • Event‑trigger names now undergo stricter validation; only alphanumeric characters, underscores, and hyphens are allowed. Existing metadata with non‑conforming names will still load, but must be corrected before the next replace_metadata call. (vendor claim)
  • Performance boost for order_by …asc_nulls_first and …desc_nulls_last on MSSQL, contributed by Behzad Fattahi. (vendor claim)

Data‑connector updates (Enterprise/Cloud only)

  • Super‑connector upgraded to Quarkus 3.33.2.1, addressing CVE‑2026‑50559, a high‑severity HTTP path‑based authorization bypass. (vendor claim)

Build and infrastructure improvements

  • Frontend/console npm dependencies updated to remediate several HIGH/CRITICAL advisories (axios, semver, and transitive packages). No user‑facing changes.
  • New environment variable HASURA_GRAPHQL_DISALLOW_INCONSISTENT_METADATA enables --disallow-inconsistent-metadata for the metadata apply command.
  • Fix for PostgreSQL SSL connection failures on FIPS‑enabled Ubuntu hosts: the container now disables forced FIPS mode during boot. (vendor claim)

Overall, v2.45.8 is a maintenance release that primarily mitigates security risks and refines MSSQL behavior. Users running Hasura on MSSQL or on FIPS‑restricted environments should prioritize upgrading.