CVE Intelligence
Analysis AI-assisted

CVE-2026-41327: Dgraph: DQL Injection in Upsert Condition Field

CVE-2026-41327 affects Dgraph releases before 25.3.3 and, according to the record, lets an unauthenticated remote attacker read database data through an unsanitized condition field in an upsert mutation. The default configuration without ACL enabled is described as affected, and GitHub reports a CVSS base score of 9.1. The sources consulted point to 25.3.3 as the fixed version, and no confirmed active exploitation appears in them.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Dgraph is an open source distributed GraphQL database. According to the record, CVE-2026-41327 is an injection flaw in a condition field of an upsert mutation, classified as CWE-943. The record describes it as reachable without authentication in the default configuration, where ACL is not enabled.

Impact

  • The record states that an unauthenticated attacker can gain full read access to all data in the database.
  • GitHub reports a CVSS base score of 9.1 with high confidentiality and integrity impact and no availability impact.
  • The record does not describe the scope of data exposure beyond this statement.

Affected products and versions

  • The record lists Dgraph Dgraph and Dgraph-io Dgraph entries as affected before 25.3.3.
  • The only fixed version string provided in the record is 25.3.3.
  • No other affected or fixed version strings are provided.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record, so no active exploitation is confirmed in the sources consulted.
  • The SSVC exploitation value in the record is poc, which suggests that proof-of-concept material may exist. This is an inference and does not confirm use in the wild.
  • The advisory reference carries an Exploit tag, which does not by itself establish exploitation in the wild.

Remediation and mitigation

  • Upgrade Dgraph to 25.3.3 or later, as indicated by the vendor advisory in the record. See the GitHub advisory.
  • Where upgrading is not immediately possible, enabling ACL is a likely way to reduce exposure in the default configuration. This is an inference from the record and should be validated against the vendor guidance.
  • Restrict network access to the database HTTP interface to trusted clients only.

Detection guidance

  • Review HTTP access logs for mutation requests to the database HTTP API that come from unexpected sources.
  • Look for upsert mutations whose condition fields contain unusual query structures or more than one query block.
  • Monitor for unexpectedly large response volumes from the database API.

Limitations of the available information

  • The record does not list affected versions beyond the boundary of 25.3.3, so the exact range of vulnerable releases is unknown.
  • The CWE name is not provided in the record.
  • The EPSS probability of 0.00475 with percentile 0.40133 is a model estimate and does not confirm exploitation.
  • This analysis relies on the record and the cited references only; the vendor advisory should be consulted for authoritative details.

Frequently asked questions

Which Dgraph versions are affected by CVE-2026-41327?

The record lists Dgraph releases before 25.3.3 as affected. No other version boundaries are provided in the sources consulted.

Does the default Dgraph configuration matter for this issue?

Yes. The record states that the default configuration, where ACL is not enabled, is affected.

Is this CVE known to be exploited in the wild?

No. The CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted. The SSVC value poc suggests proof-of-concept material may exist.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.