Read the docs
TI-2026-45279 Aliases CVE-2026-63637

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Priority HIGH 76CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00408 35th percentileScored 2026-11-07
Fix Fixed dgraph (dgraph-io): 25.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dgraph-iodgraphbefore 25.3.825.3.8Patch availableCNA
  • dgraph Vendordgraph-io Affected before 25.3.8 Fixed in 25.3.8 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:*——dgraph-io
  • cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:* Versions — — ·dgraph-io

Remediation

  • Fix · CNA dgraph (dgraph-io) Fixed in 25.3.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63637

References

Other 2

  • TI-2026-30079 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph CVSS 3.1CRITICAL 9.8
  • TI-2026-28987 Dgraph: Unauthenticated pprof endpoint leaks admin auth token CVSS 3.1CRITICAL 9.4
  • TI-2026-27198 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVSS 3.1CRITICAL 10.0
  • TI-2026-38995 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVSS 3.1CRITICAL 9.1
  • TI-2026-29929 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVSS 3.1CRITICAL 9.1
  • TI-2026-29928 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVSS 3.1CRITICAL 9.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences