GO-2026-5837
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph
At a glance
- Published
- Updated
- CVE
- CVE-2026-44840
- Aliases
- GHSA-q2m9-6jp9-c6mc
Description
The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/hypermodeinc/dgraph/v24 | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.4 |
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc ADVISORY
- https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac FIX
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |