CVE-2026-41328: Dgraph: unauthenticated DQL injection via NQuad language field
Dgraph, an open source distributed GraphQL database, has a critical flaw described in the record as allowing an unauthenticated attacker to read all data in the database in its default configuration without ACL. The issue is a DQL injection through the language tag of mutation keys, and the record states it is fixed in 25.3.3. The record reports a CVSS base score of 9.1 and an SSVC exploitation value of poc, but no KEV listing.
Overview
The record describes an unauthenticated DQL injection in Dgraph, reached through the language tag portion of JSON mutation keys. According to the description, the flaw affects default configurations where ACL is not enabled and is fixed in 25.3.3. The vendor advisory is the primary reference cited in the record.
Impact
- The description states that an unauthenticated attacker can obtain read access to all data in the database.
- The CVSS base score of 9.1 is reported by GitHub as a source, with high confidentiality and integrity impact in the reported vector.
- The CWE assigned is CWE-943 (improper neutralization of special elements in data query logic). The record does not give a CWE name.
Affected products and versions
- Dgraph Dgraph: versions before 25.3.3.
- Dgraph-io Dgraph: versions before 25.3.3.
- The record lists two product entries with different naming for the same project; this should be confirmed against the vendor advisory.
Exploitation status
The KEV catalog flag in the record is false, so no active exploitation is confirmed by the sources consulted. The SSVC field records exploitation as poc, which indicates a proof-of-concept is considered to exist, and the automatable field is yes. These are assessments in the record, not confirmations of attacks in the wild.
Remediation and mitigation
- Upgrade Dgraph to version 25.3.3 or later, which the record identifies as the fixed release.
- Review the vendor advisory linked in the record for the official guidance and any additional mitigation steps.
- Enable ACL and restrict network access to administrative and data endpoints, since the description ties the exposure to the default configuration without ACL.
- Limit exposure of the database HTTP port to trusted networks until the upgrade is applied.
Detection guidance
- Review access logs for unexpected schema changes and unusual mutation requests from unknown clients.
- Check for predicate definitions or language tags that do not match the application's normal data model.
- Audit recent query results and data exports for activity not tied to known users or services.
Limitations of the available information
- The record does not provide a CVSS vector source beyond the advisory provider, nor independent confirmation of exploitation.
- The record does not include exploit code, and this analysis does not describe operational steps.
- Whether earlier releases had any partial mitigation is unknown from the record.
- The EPSS probability of 0.0048 is a model estimate and does not indicate observed exploitation.
Frequently asked questions
Which Dgraph versions are affected?
According to the record, Dgraph versions before 25.3.3 are affected. The record lists two product entries for the same project, which should be checked against the vendor advisory.
Is this vulnerability being actively exploited?
The KEV flag in the record is false, so no active exploitation is confirmed by the sources consulted. The SSVC field lists exploitation as poc, which is an assessment in the record and not confirmation of attacks.
What is the recommended fix?
The record identifies 25.3.3 as the fixed release. Upgrading to that version or later, enabling ACL and restricting network access are the main defensive steps described.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.