9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41328

CVE-2026-41328: Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack requires two HTTP POSTs to port 8080. The first sets up a schema predicate with @unique @index(exact) @lang via /alter (also unauthenticated in default config). The second sends a crafted JSON mutation to /mutate?commitNow=true where a JSON key contains the predicate name followed by @ and a DQL injection payload in the language tag position. The injection exploits the addQueryIfUnique function in edgraph/server.go, which constructs DQL queries using fmt.Sprintf with unsanitized predicateName that includes the raw pred.Lang value. The Lang field is extracted from JSON mutation keys by x.PredicateLang(), which splits on @, and is never validated by any function in the codebase. The attacker injects a closing parenthesis to escape the eq() function, adds an arbitrary named query block, and uses a # comment to neutralize trailing template syntax. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41328

CVE-2026-41328:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dgraph-io/dgraph/v25	go	< 25.3.3	25.3.3
github.com/dgraph-io/dgraph/v24	go	<= 24.1.8
github.com/dgraph-io/dgraph	go	<= 1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided vulnerability description and the associated patch commit 55e3b79817e87512297695f7dccae86130d0c81e confirms the presence of multiple DQL injection vulnerabilities in Dgraph. The primary vulnerability, as detailed in the report, resides in the addQueryIfUnique function within edgraph/server.go. This function failed to sanitize the language tag (pred.Lang) extracted from a user-controlled JSON key before incorporating it into a DQL query via fmt.Sprintf. This allowed an unauthenticated attacker to inject arbitrary DQL and exfiltrate the entire database.

The patch addresses this by introducing a new function, validateLangTag, which uses a regular expression to ensure the language tag conforms to the BCP 47 standard, effectively blocking the injection.

A secondary injection vector was identified and patched in the buildUpsertQuery function in the same file. This function was vulnerable to injection via the cond field in mutations. The fix involves a new validateCondValue function that strictly validates the structure of the conditional expression, preventing the injection of additional query blocks. The commit also includes fixes for potential injection through val() references in ObjectIds, also within addQueryIfUnique. The presence of new test files and functions like TestDQLInjectionViaCondField and TestValidateLangTag further corroborates these findings.

Vulnerable functions

addQueryIfUnique

edgraph/server.go

The function `addQueryIfUnique` was vulnerable to DQL injection because it used the `pred.Lang` field, which is derived from user input in a JSON mutation, to construct a DQL query string using `fmt.Sprintf` without proper sanitization. An attacker could provide a malicious string in the language part of a predicate (e.g., `name@en,...)`) to inject arbitrary DQL, allowing for data exfiltration. The patch adds validation for the language tag using the `validateLangTag` function.

buildUpsertQuery

edgraph/server.go

The function `buildUpsertQuery` was vulnerable to DQL injection through the `cond` field of a mutation. A crafted `cond` value could be used to terminate the intended query structure and inject additional, malicious DQL query blocks. The patch introduces the `validateCondValue` function to parse and validate the structure of the `cond` string, ensuring it is a well-formed condition and does not contain any malicious appended queries.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.