CVE-2026-41327: Dgraph GraphQL Database SQLi Vulnerability

CVE-2026-41327 Overview

CVE-2026-41327 is a critical DQL (Dgraph Query Language) injection vulnerability in Dgraph, an open source distributed GraphQL database. This flaw allows unauthenticated attackers to gain full read access to every piece of data stored in the database by exploiting improper input handling in upsert mutations. The vulnerability affects Dgraph installations running the default configuration where Access Control Lists (ACL) are not enabled.

Critical Impact

Unauthenticated attackers can extract the entire contents of Dgraph databases through a single crafted HTTP POST request, leading to complete data exfiltration without any authentication requirements.

Affected Products

• Dgraph versions prior to 25.3.3
• Dgraph installations with default configuration (ACL disabled)
• Dgraph Go module (cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*)

Discovery Timeline

• 2026-04-24 - CVE-2026-41327 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41327

Vulnerability Analysis

This vulnerability represents a classic injection flaw (CWE-943: Improper Neutralization of Special Elements in Data Query Logic) that occurs when user-controlled input is incorporated into query strings without proper sanitization. The attack exploits Dgraph's upsert mutation endpoint, where the cond field value is directly concatenated into a DQL query string using strings.Builder.WriteString after only a superficial strings.Replace transformation.

The lack of proper escaping, parameterization, or structural validation allows an attacker to break out of the intended query context and inject arbitrary DQL query blocks. The DQL parser accepts these injected blocks as syntactically valid named query blocks, executing them server-side and returning the results directly in the HTTP response.

Root Cause

The root cause of CVE-2026-41327 lies in the unsafe string concatenation pattern used when building DQL queries from user input. Specifically, the cond field in upsert mutations undergoes only a cosmetic transformation via strings.Replace before being concatenated into the query string. This approach fails to:

1. Properly escape special characters that have syntactic meaning in DQL
2. Implement parameterized queries or prepared statements
3. Validate the structural integrity of the input to ensure it conforms to expected patterns
4. Reject input containing query block delimiters or other injection payloads

Attack Vector

The attack is remarkably straightforward, requiring only a single HTTP POST request to the /mutate?commitNow=true endpoint. An attacker crafts a malicious cond field value within an upsert mutation that contains an additional DQL query block. When processed by the vulnerable code path, this injected query block is parsed and executed alongside the legitimate query, with results returned to the attacker.

The network-based attack vector requires no authentication and no user interaction, making it highly exploitable against any internet-exposed Dgraph instance running without ACL enabled. The attacker can systematically enumerate and extract all data from the database by iterating through different query patterns.

Since no verified code examples are available, readers should consult the GitHub Security Advisory GHSA-mrxx-39g5-ph77 for detailed technical information about the vulnerability mechanism and exploitation technique.

Detection Methods for CVE-2026-41327

Indicators of Compromise

• Unusual or high-volume POST requests to /mutate?commitNow=true endpoint from external IP addresses
• HTTP responses containing unexpected data structures or large result sets from mutation endpoints
• Log entries showing DQL queries with multiple named query blocks where only one was expected
• Authentication-free access patterns to sensitive data that should require ACL permissions

Detection Strategies

• Monitor HTTP traffic for POST requests to /mutate endpoints containing suspicious cond field patterns
• Implement Web Application Firewall (WAF) rules to detect and block DQL injection patterns in request bodies
• Analyze Dgraph query logs for queries containing unexpected query block structures or delimiters
• Deploy network-based intrusion detection signatures targeting GraphQL/DQL injection attempts

Monitoring Recommendations

• Enable comprehensive audit logging for all mutation requests in Dgraph deployments
• Set up alerting for unusually large response payloads from mutation endpoints
• Implement rate limiting on mutation endpoints to slow down potential data exfiltration attempts
• Monitor for bulk data access patterns that deviate from normal application behavior

How to Mitigate CVE-2026-41327

Immediate Actions Required

• Upgrade Dgraph to version 25.3.3 or later immediately to receive the security fix
• Enable ACL (Access Control Lists) on all Dgraph deployments to require authentication
• Restrict network access to Dgraph endpoints using firewall rules or network segmentation
• Review access logs for evidence of exploitation prior to patching

Patch Information

Dgraph has released version 25.3.3 which addresses this vulnerability by implementing proper input validation and sanitization for the cond field in upsert mutations. Organizations should upgrade to this version immediately. The release is available from the GitHub Release v25.3.3.

For additional details about the vulnerability and the fix, refer to the GitHub Security Advisory GHSA-mrxx-39g5-ph77.

Workarounds

• Enable ACL on Dgraph deployments to require authentication for all database operations
• Place Dgraph behind a reverse proxy with strict input validation rules
• Restrict network access to Dgraph endpoints to trusted internal networks only
• Implement application-level input validation for any user data passed to Dgraph mutations

# Example: Enable ACL in Dgraph configuration
# Add the following flags when starting Dgraph Alpha
dgraph alpha --acl "secret-file=/path/to/hmac-secret" \
  --whitelist "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"