CVE-2026-41327 Details
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3.
A pre-authentication vulnerability has been identified in Dgraph, an open-source distributed GraphQL database, prior to version 25.3.3. This vulnerability allows an unauthenticated attacker to gain full read access to all data in the database, exploiting the default configuration where Access Control Lists (ACL) are not enabled. The issue arises from the '/mutate?commitNow=true' endpoint, which accepts a 'cond' field in upsert mutations. The 'cond' value is directly concatenated into a DQL query without proper sanitization or validation, allowing attackers to inject additional query blocks that are executed server-side. The results of these injected queries are then returned in the HTTP response.
Users can upgrade to Dgraph version 25.3.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 | [email protected] | Release Notes |
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dgraph dgraph | < 25.3.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | [email protected] |
| Apr 24, 2026 | CVE Modified | CISA-ADP |