# CVE-2026-44840: Dgraph DQL injection in checkUserPassword GraphQL query

Source: https://junglewise.ai/threats/cve-2026-44840-dgraph-dql-injection-in-checkuserpassword-graphql-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-44840 · Severity: high · CVSS 7.5 · Published 2026-07-08

Dgraph is an open-source distributed database used to store and query complex data. A security flaw in its password verification process allows unauthenticated attackers to bypass intended query restrictions. By sending a specially crafted request, an attacker can execute unauthorized database commands, potentially leading to the discovery of sensitive data structures or causing service disruptions through resource exhaustion.

Technologies: [Dgraph Labs Dgraph](https://junglewise.ai/threats/technologies/dgraph), [github.com/dgraph-io/dgraph (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph), [github.com/dgraph-io/dgraph/v25 (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph-v25), [github.com/hypermodeinc/dgraph/v24 (Go)](https://junglewise.ai/threats/technologies/github-com-hypermodeinc-dgraph-v24). Vendors: [Dgraph Labs](https://junglewise.ai/threats/vendors/dgraph-labs), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44840 being exploited in the wild.

**How severe is CVE-2026-44840?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** Dgraph Labs Dgraph <= 25.3.3; github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0; github.com/dgraph-io/dgraph/v25 (Go) <= 25.3.3, SEMVER:introduced=0,fixed=25.3.4; github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=0.

**Is there a fix for CVE-2026-44840?** Yes. github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44840 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-44840?** Check whether you run Dgraph Labs Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v25 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.4 or later

  ```sh
  go get github.com/dgraph-io/dgraph/v25@v25.3.4
  ```


## Technical details

A DQL injection vulnerability exists in the GraphQL-to-DQL query rewriting layer of Dgraph. The root cause is the use of `fmt.Sprintf` in `query_rewriter.go` to interpolate user-supplied password values directly into a `checkpwd()` DQL function without escaping. An attacker can provide a password containing double-quote characters to break out of the string literal and append arbitrary DQL query blocks. This can be exploited via unauthenticated network requests to the GraphQL endpoint. Successful exploitation allows for schema discovery, data enumeration via server logs/metrics, and resource exhaustion. The issue is patched in version 25.3.4.

## Affected products

- Dgraph Labs Dgraph <= 25.3.3

## Identifiers

- CVE-2026-44840
- GHSA-q2m9-6jp9-c6mc
- GO-2026-5837

## Timeline

- 2026-05-11: patched: Fix committed to repository and version 25.3.4 released.
- 2026-06-29: advisory: GitHub Security Advisory GHSA-q2m9-6jp9-c6mc published.
- 2026-07-08: disclosed: CVE-2026-44840 published to NVD.

## References

- [https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac](https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac)
- [https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4](https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4)
- [https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc](https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc)

## Related threats

- [Dgraph Zero unauthenticated HTTP admin denial of service](https://junglewise.ai/threats/cve-2026-102748-dgraph-zero-unauthenticated-http-admin-removenode-denial-of)
- [Dgraph Alpha missing authentication for external snapshot import](https://junglewise.ai/threats/cve-2026-54061-dgraph-alpha-missing-authentication-for-external-snapshot-import)
- [GO-2026-5675 - Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41492-dgraph-unauthenticated-admin-token-disclosure-leading-to)
- [GO-2026-5749 - DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41328-dgraph-pre-auth-full-database-exfiltration-via-dql-injection-in)
- [GO-2026-5516 - Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41327-dgraph-pre-auth-full-database-exfiltration-via-dql-injection-in)