djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 4TUResearchData | djehuty | before 26.3.2 | 26.3.2 | Patch available | CNA |
- djehuty Vendor4TUResearchData Affected before 26.3.2 Fixed in 26.3.2 Patch available CNA
Remediation
- Fix · CNA djehuty (4TUResearchData) Fixed in 26.3.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73976
References
More 4TUResearchData vulnerabilities
- TI-2026-51980 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples CVSS 4.0HIGH 8.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences