7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44840

CVE-2026-44840: Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the checkUserPassword GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL checkpwd() query via fmt.Sprintf without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44840

CVE-2026-44840:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dgraph-io/dgraph/v25	go	<= 25.3.3	25.3.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a DQL injection in Dgraph's GraphQL layer, specifically in the handling of the checkUserPassword query. The root cause is the unsafe construction of a DQL query using fmt.Sprintf in the passwordQuery function, located in graphql/resolve/query_rewriter.go. User-controlled input (the password) is directly embedded into the query string, allowing an attacker to inject arbitrary DQL by providing a password containing a double-quote character.

The patch addresses this by changing the query construction to use parameterized queries. Instead of interpolating the password directly, the new code uses a placeholder ($pwd0) in the DQL string and passes the password as a separate variable to the Dgraph query executor. This prevents the password from being interpreted as DQL code.

The analysis of the patch commit cee702c93f141eeb0c96a81f70830ec9e459efac confirms this. The changes in graphql/resolve/query_rewriter.go show the modification in passwordQuery to use a variable. The function signature of queryRewriter.Rewrite was updated to return these variables, and queryResolver.rewriteAndExecute in graphql/resolve/query.go was updated to pass these variables to the query executor. Therefore, passwordQuery is the primary vulnerable function, and queryRewriter.Rewrite and queryResolver.rewriteAndExecute are key functions in the vulnerable execution flow.

Vulnerable functions

passwordQuery

graphql/resolve/query_rewriter.go

The `passwordQuery` function is vulnerable to DQL injection. It uses `fmt.Sprintf` to directly interpolate a user-provided password into a DQL query string. An attacker can include a double-quote in the password to break out of the string literal and inject arbitrary DQL.

queryRewriter.Rewrite

graphql/resolve/query_rewriter.go

The `Rewrite` method of `queryRewriter` is the entry point that dispatches to the vulnerable `passwordQuery` function when handling a `schema.PasswordQuery`. The change in its signature is part of the fix to allow passing parameterized variables.

queryResolver.rewriteAndExecute

graphql/resolve/query.go

This function calls the `queryRewriter.Rewrite` method to generate the DQL query. It is part of the vulnerable execution path that leads to the construction and execution of the injected query. The patch modifies this function to handle the new parameterized query variables.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.