Read the docs
TI-2026-32720 Aliases CVE-2026-44840GHSA-q2m9-6jp9-c6mc

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Priority HIGH 72CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed dgraph (dgraph-io): 25.3.4github.com/dgraph-io/dgraph/v25 (Go): 25.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dgraph-iodgraphbefore 25.3.425.3.4Patch availableCNA
—github.com/dgraph-io/dgraph/v25 (Go)before 25.3.425.3.4Patch availableGHSA-q2m9-6jp9-c6mc
  • dgraph Vendordgraph-io Affected before 25.3.4 Fixed in 25.3.4 Patch available CNA
  • github.com/dgraph-io/dgraph/v25 (Go) Vendor— Affected before 25.3.4 Fixed in 25.3.4 Patch available GHSA-q2m9-6jp9-c6mc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:*——dgraph-io
  • cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:* Versions — — ·dgraph-io

Remediation

  • Fix · CNA dgraph (dgraph-io) Fixed in 25.3.4
  • Fix · GHSA-q2m9-6jp9-c6mc github.com/dgraph-io/dgraph/v25 (Go) Fixed in 25.3.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44840
  2. 2026-10-03 Alias added: GHSA-q2m9-6jp9-c6mc

References

Other 4

  • TI-2026-30079 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph CVSS 3.1CRITICAL 9.8
  • TI-2026-28987 Dgraph: Unauthenticated pprof endpoint leaks admin auth token CVSS 3.1CRITICAL 9.4
  • TI-2026-27198 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVSS 3.1CRITICAL 10.0
  • TI-2026-38995 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVSS 3.1CRITICAL 9.1
  • TI-2026-29929 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVSS 3.1CRITICAL 9.1
  • TI-2026-29928 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVSS 3.1CRITICAL 9.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences