CVE-2026-44840
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.
Risk Assessment
The risk involves potential unauthorized access to or manipulation of data in the Dgraph database through malicious DQL injection. This could lead to a breach of data confidentiality and integrity.
Recommendation
Immediately upgrade Dgraph to version 25.3.4 or later, which includes a fix that eliminates the DQL injection vulnerability.
Original NVD description (English source)
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.