CVE-2026-63637
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Dgraph before version 25.3.8 in maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without proper quoting or validation, allowing injection of DQL operators, disclosure of unintended nodes, or expansion of modification and deletion targets. The issue is fixed in version 25.3.8.
Risk Assessment
An attacker can manipulate GraphQL queries, potentially leading to unauthorized data access or unwanted changes in the database.
Recommendation
Update Dgraph to version 25.3.8 or later. Additionally, validate and sanitize input filters.
Other vulnerabilities in Dgraph
See all- CVE-2026-54061Critical
Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.
- CVE-2026-44840High
In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.
Original NVD description (English source)
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.