CVE-2026-44840

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

Affected

dgraph-io · dgraph

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.49% chance of exploitation in the next 30 days, 41st percentile

Published

2026-07-08

Updated

2026-07-09

Proof-of-concept exploits (2)

• advisories/GHSA-q2m9-6jp9-c6mc
• isaca0315/CVE-2026-44840-poc0★ · 2026-09-17

References

• CVE Record
• NVD entry

Related

• CVE-2026-44351
• CVE-2026-44578
• CVE-2026-64849
• CVE-2026-65013