CVE-2026-44840 Details

A DQL injection vulnerability has been identified in the Dgraph GraphQL database, affecting versions through 25.3.3. The issue arises in the checkUserPassword query, where user-provided password values are directly inserted into a DQL checkpwd() query using fmt.Sprintf, without proper escaping or parameterization. This flaw allows attackers to inject passwords containing double-quote characters to escape the DQL string literal and append arbitrary DQL query blocks. The vulnerability exists in the GraphQL-to-DQL query rewriting layer, specifically in query_rewriter.go, where the checkpwd() function is constructed with unsanitized input. Exploitation can lead to unauthorized data enumeration, schema discovery, resource exhaustion, and potential data disclosure, depending on the Dgraph configuration.

Users can upgrade to Dgraph version 25.3.4, which patches this vulnerability by properly escaping and parameterizing password values in the checkUserPassword query.