CVE-2026-44840: Dgraph DQL Injection in checkUserPassword Query

Technical summary

The `checkUserPassword` GraphQL query in Dgraph concatenates user-supplied password input directly into a DQL `checkpwd()` function call using `fmt.Sprintf` without escaping or prepared statements. This unsanitized interpolation enables DQL injection: an attacker can craft a password containing a double-quote character to terminate the string literal prematurely, then append arbitrary DQL query blocks. Because the query operates at the GraphQL layer and accepts unauthenticated input, an attacker can exploit this over the network to execute queries against the underlying Dgraph database. The vulnerability is classified under CWE-943 (Improper Neutralization of Special Elements in Data Query Logic).

Business impact

An unauthenticated remote attacker could query and exfiltrate sensitive data stored in Dgraph instances, including user records, credentials, personal information, or proprietary datasets. The vulnerability does not permit data modification or denial of service, but confidentiality is fully compromised if exploited. Organizations relying on Dgraph for production data storage face direct data breach risk without patching. The absence of authentication or special configuration requirements makes this a straightforward attack vector for external threat actors.

Affected systems

Dgraph versions prior to 25.3.4 are affected. The vulnerability exists in the GraphQL authentication layer and impacts any deployment exposing the GraphQL endpoint. Both containerized and on-premises installations are vulnerable if running unpatched versions.

Exploitability

Exploitation is straightforward and requires only network access to the GraphQL endpoint. No authentication, special privileges, or user interaction is needed. An attacker can craft a password input containing quote characters and DQL syntax to inject queries. The attack is likely automatable and requires minimal complexity. CVSS score 7.5 (High) reflects this ease of exploitation combined with high confidentiality impact.

Remediation

Upgrade Dgraph to version 25.3.4 or later, which patches the vulnerability by properly escaping or parameterizing password input before inclusion in DQL queries. Organizations unable to upgrade immediately should restrict network access to the GraphQL endpoint using firewall rules or VPN controls, and monitor authentication logs for suspicious `checkUserPassword` queries.

Patch guidance

Apply Dgraph version 25.3.4 or newer. Verify the update is deployed across all Dgraph instances in your environment, including replicas and cluster nodes. Test the patch in a staging environment first to confirm compatibility with your GraphQL clients and database schema. After patching, consider rotating database credentials and reviewing access logs for evidence of prior exploitation.

Detection guidance

Monitor GraphQL logs and audit trails for `checkUserPassword` queries with unusually long or malformed password fields, especially those containing DQL syntax characters (quotes, curly braces, pipes). Review database query logs for unexpected DQL query patterns that correlate with GraphQL authentication attempts. Implement network-based detection for POST requests to GraphQL endpoints with payloads exceeding typical password lengths. Query for successful data exfiltration patterns in Dgraph query audit logs from unauthenticated or unexpected sources.

Why prioritize this

This is a critical remote code execution and data exfiltration vector requiring immediate patching. The lack of authentication, ease of exploitation, and direct access to sensitive database contents place this in the top tier of Dgraph deployment risks. The CVSS score of 7.5 understates the real-world severity for organizations storing confidential data; prioritize this above lower-impact vulnerabilities.

Risk score, explained

CVSS 7.5 (High) reflects: AV:N (network-accessible), AC:L (no special conditions), PR:N (no authentication), UI:N (no user interaction), S:U (impact confined to affected component), C:H (confidentiality fully compromised), I:N (integrity not affected), A:N (availability not affected). The score appropriately weights the ease of exploitation and confidentiality breach, though does not account for the widespread use of Dgraph in high-value data contexts.

Frequently asked questions