CVE-2026-44840
High
Description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductGithub.com/dgraph-io/dgraph/v25
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-943CWE-943
How to fix
Update
- github.com/dgraph-io/dgraph/v2525.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/dgraph-io/dgraph/v25Go | v < 25.3.4 | 25.3.4 |
| github.com/dgraph-io/dgraphGo | No range specified | — |
| github.com/hypermodeinc/dgraph/v24Go | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.