Executive brief
Dgraph is an open-source distributed database used to store and query complex data. A security flaw in its password verification process allows unauthenticated attackers to bypass intended query restrictions. By sending a specially crafted request, an attacker can execute unauthorized database commands, potentially leading to the discovery of sensitive data structures or causing service disruptions through resource exhaustion.
Technical details
A DQL injection vulnerability exists in the GraphQL-to-DQL query rewriting layer of Dgraph. The root cause is the use of `fmt.Sprintf` in `query_rewriter.go` to interpolate user-supplied password values directly into a `checkpwd()` DQL function without escaping. An attacker can provide a password containing double-quote characters to break out of the string literal and append arbitrary DQL query blocks. This can be exploited via unauthenticated network requests to the GraphQL endpoint. Successful exploitation allows for schema discovery, data enumeration via server logs/metrics, and resource exhaustion. The issue is patched in version 25.3.4.
Affected products
- Dgraph Labs Dgraph <= 25.3.3
Timeline
- 2026-05-11: patched: Fix committed to repository and version 25.3.4 released.
- 2026-06-29: advisory: GitHub Security Advisory GHSA-q2m9-6jp9-c6mc published.
- 2026-07-08: disclosed: CVE-2026-44840 published to NVD.