CVE-2026-44840

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac
https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4
https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc
https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc

Configurations

No configuration.

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Dgraph es una base de datos GraphQL distribuida de código abierto. Antes de la versión 25.3.4, la consulta GraphQL ’checkUserPassword’ en Dgraph es vulnerable a la inyección de DQL (Dgraph Query Language). Los valores de contraseña proporcionados por el usuario se interpolan directamente en una consulta DQL ’checkpwd()’ a través de ’fmt.Sprintf’ sin ningún escape o parametrización. Un atacante puede inyectar una contraseña que contenga un carácter de comilla doble para salir del literal de cadena DQL y adjuntar bloques de consulta DQL arbitrarios. La versión 25.3.4 corrige el problema.

Information

Published : 2026-07-08 14:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-44840

Mitre link : CVE-2026-44840

CVE.ORG link : CVE-2026-44840

JSON object : View

Products Affected

No product.

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-44840", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44840", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:28:28.118081Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dgraph-io", "product": "dgraph", "versions": [{"status": "affected", "version": "< 25.3.4"}]}]}], "published": "2026-07-08T14:16:59.493", "references": [{"url": "https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac", "source": "security-advisories@github.com"}, {"url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc", "source": "security-advisories@github.com"}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue."}, {"lang": "es", "value": "Dgraph es una base de datos GraphQL distribuida de c\u00f3digo abierto. Antes de la versi\u00f3n 25.3.4, la consulta GraphQL \u2019checkUserPassword\u2019 en Dgraph es vulnerable a la inyecci\u00f3n de DQL (Dgraph Query Language). Los valores de contrase\u00f1a proporcionados por el usuario se interpolan directamente en una consulta DQL \u2019checkpwd()\u2019 a trav\u00e9s de \u2019fmt.Sprintf\u2019 sin ning\u00fan escape o parametrizaci\u00f3n. Un atacante puede inyectar una contrase\u00f1a que contenga un car\u00e1cter de comilla doble para salir del literal de cadena DQL y adjuntar bloques de consulta DQL arbitrarios. La versi\u00f3n 25.3.4 corrige el problema."}], "lastModified": "2026-10-25T20:10:00.147", "sourceIdentifier": "security-advisories@github.com"}