PT-2026-53759 · Dgraph · Dgraph

CVE-2026-44840

·

Published

2026-06-29

·

Updated

2026-07-30

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.4
Description The checkUserPassword GraphQL query is susceptible to DQL (Dgraph Query Language) injection. This occurs because user-supplied password values are interpolated directly into a DQL checkpwd() query using fmt.Sprintf without proper escaping or parameterization. An attacker can provide a password containing a double-quote character to escape the DQL string literal and execute arbitrary DQL query blocks.
Recommendations Update to version 25.3.4.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-943

Related Identifiers

CVE-2026-44840
GHSA-Q2M9-6JP9-C6MC
GO-2026-5837
OPENSUSE-SU-2026:21483-1

Affected Products

Dgraph