Dgraph vulnerabilities
3 known CVE vulnerabilities in Dgraph, translated and rated.
- CVE-2026-54061Critical
Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.
- CVE-2026-63637High
Dgraph before version 25.3.8 in maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without proper quoting or validation, allowing injection of DQL operators, disclosure of unintended nodes, or expansion of modification and deletion targets. The issue is fixed in version 25.3.8.
- CVE-2026-44840High
In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.