CVE-2026-41327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41327", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T14:01:46.672Z", "datePublished": "2026-04-24T18:27:51.477Z", "dateUpdated": "2026-04-24T19:05:56.125Z"}, "containers": {"cna": {"title": "Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field", "problemTypes": [{"descriptions": [{"cweId": "CWE-943", "lang": "en", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77"}, {"name": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3"}], "affected": [{"vendor": "dgraph-io", "product": "dgraph", "versions": [{"version": "< 25.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T18:27:51.477Z"}, "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3."}], "source": {"advisory": "GHSA-mrxx-39g5-ph77", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T19:04:19.112167Z", "id": "CVE-2026-41327", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T19:05:56.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41327", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T19:04:19.112167Z"}}}], "references": [{"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T19:04:44.917Z"}}], "cna": {"title": "Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field", "source": {"advisory": "GHSA-mrxx-39g5-ph77", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dgraph-io", "product": "dgraph", "versions": [{"status": "affected", "version": "< 25.3.3"}]}], "references": [{"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "name": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3", "name": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-943", "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T18:27:51.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41327", "state": "PUBLISHED", "dateUpdated": "2026-04-24T19:05:56.125Z", "dateReserved": "2026-04-20T14:01:46.672Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T18:27:51.477Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dgraph", "vendor": "dgraph-io", "versions": [{"status": "affected", "version": "< 25.3.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*", "matchCriteriaId": "03E6E13D-4051-49C6-BDFB-3B66E2002401", "versionEndExcluding": "25.3.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3."}, {"lang": "es", "value": "Dgraph es una base de datos GraphQL distribuida de c\u00f3digo abierto. Antes de la versi\u00f3n 25.3.3, se ha encontrado una vulnerabilidad en Dgraph que otorga a un atacante no autenticado acceso de lectura completo a cada pieza de datos en la base de datos. Esto afecta la configuraci\u00f3n predeterminada de Dgraph donde ACL no est\u00e1 habilitado. El ataque es un \u00fanico POST HTTP a /mutate?commitNow=true que contiene un campo cond manipulado en una mutaci\u00f3n upsert. El valor de cond se concatena directamente en una cadena de consulta DQL a trav\u00e9s de strings.Builder.WriteString despu\u00e9s de solo una transformaci\u00f3n cosm\u00e9tica de strings.Replace. No se aplica escape, parametrizaci\u00f3n o validaci\u00f3n estructural. Un atacante inyecta un bloque de consulta DQL adicional en la cadena cond, que el analizador DQL acepta como un bloque de consulta con nombre sint\u00e1cticamente v\u00e1lido. La consulta inyectada se ejecuta en el lado del servidor y sus resultados se devuelven en la respuesta HTTP. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 25.3.3."}], "id": "CVE-2026-41327", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41327", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T19:04:19.112167Z", "version": "2.0.3"}}]}, "published": "2026-04-24T19:17:12.407", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-943"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.3.3)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "dgraph", "source": "cna", "vendor": "dgraph-io"}, "product": "dgraph", "vendor": "dgraph"}], "analysis": {"en": {"generated_at": "2026-04-28T05:54:09.859188+00:00", "value": {"mitigation_remediation": ["Upgrade to Dgraph 25.3.3 or later, which patches the injection flaw.", "Enable ACL and require authentication to prevent anonymous access to the database.", "If patching is delayed, restrict network access to the /mutate endpoint to limit exposure."], "summary": {"action": "Immediate Patch", "impact": "Full-Database Exfiltration"}, "threat_synthesis": {"affected_systems": "The affected product is Dgraph, the open\u2011source distributed GraphQL database from dgraph\u2011io. All deployments using the default configuration in which ACL is disabled are vulnerable. Versions prior to 25.3.3 contain the flaw; the issue is fixed in 25.3.3.", "description_and_impact": "A vulnerability in Dgraph allows an unauthenticated attacker to exfiltrate all stored data by injecting a malicious DQL query into the cond field of an upsert mutation. The injected query is concatenated into the mutation without any escaping or validation, which the DQL parser accepts as a new named query block. The query executes server\u2011side and its results are returned to the attacker, giving complete read access to the database. This issue is classified as CWE\u2011943 due to improper handling of input that results in disclosure of sensitive information.", "risk_and_exploitability": "The CVSS rating of 9.1 indicates a high\u2011severity vulnerability. The exploit probability is low, with an EPSS score below 1%, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, the attack requires only a single HTTP POST to /mutate?commitNow=true with a crafted cond string and no authentication is necessary, meaning any exposed Dgraph instance with default settings can be exploited. Once exploited, an attacker can read every data item in the database, resulting in total data exfiltration."}}}}, "created": "2026-04-28T06:00:09.604653+00:00", "updated": "2026-04-28T08:45:26.955454+00:00", "vendors": ["dgraph", "dgraph$PRODUCT$dgraph"]}