CVE-2026-44840— Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44840
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Source: NVD (National Vulnerability Database)
Vulnerability Description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44840
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 5962 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-44840
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-44840 (1)
Vendor Advisories for CVE-2026-44840 (1)
Vendor Pages for CVE-2026-44840 (1)
- 🔗 Release v25.3.4 · dgraph-io/dgraph · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: dgraph
- CVE-2026-54061
Dgraph Alpha group stores can be replaced via unauthenticate - CVE-2026-41492
Unauthenticated Admin Token Disclosure Leading to Authentica - CVE-2026-41327
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injectio - CVE-2026-41328
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injectio - CVE-2026-40173
Dgraph: Unauthenticated pprof endpoint leaks admin auth toke
Same vendor: dgraph-io
- CVE-2026-54061
Dgraph Alpha group stores can be replaced via unauthenticate - CVE-2026-41492
Unauthenticated Admin Token Disclosure Leading to Authentica - CVE-2026-41327
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injectio - CVE-2026-41328
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injectio - CVE-2026-40173
Dgraph: Unauthenticated pprof endpoint leaks admin auth toke
Same weakness: CWE-943
- CVE-2026-8649
Institution scope bypass vulnerability in custom reports - CVE-2026-10698
Table scope bypass vulnerability in custom reports - CVE-2026-40141
High-Severity Vulnerability In Web Application Component of - CVE-2026-46591
Apache Camel: Camel-Neo4j: JSON property names from the Came - CVE-2026-45689
Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoi
V. Comments for CVE-2026-44840
No comments yet