CVE-2026-44840: Dgraph Database SQLI Vulnerability

CVE-2026-44840 Overview

CVE-2026-44840 is a Dgraph Query Language (DQL) injection vulnerability in Dgraph, an open source distributed GraphQL database. The flaw resides in the checkUserPassword GraphQL query, where user-supplied password values are interpolated directly into a DQL checkpwd() query using fmt.Sprintf without escaping or parameterization. Attackers can inject a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. The vulnerability affects all Dgraph versions prior to 25.3.4, which contains the patch. This issue is categorized under [CWE-943] Improper Neutralization of Special Elements in Data Query Logic.

Critical Impact
Unauthenticated network attackers can inject arbitrary DQL query blocks through the login flow, enabling extraction of confidential data from the Dgraph database without valid credentials.

Affected Products

Dgraph distributed GraphQL database, all versions prior to 25.3.4
Deployments exposing the checkUserPassword GraphQL admin query
Applications relying on Dgraph ACL for authentication

Discovery Timeline

2026-07-08 - CVE-2026-44840 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-44840

Vulnerability Analysis

The vulnerability exists in Dgraph's GraphQL admin resolver responsible for verifying user credentials. When a client invokes the checkUserPassword query, the resolver constructs a DQL query that calls the checkpwd() function to compare the supplied password against the stored hash. The supplied password is inserted into the DQL string using fmt.Sprintf, treating attacker-controlled input as trusted query text. Because the password field accepts arbitrary characters, an attacker can submit a value containing a double quote to terminate the intended string literal. The remainder of the input is then parsed as DQL, allowing the attacker to append additional query blocks executed by the Dgraph engine.

Root Cause

The root cause is unsafe string concatenation of untrusted input into a query language expression. The Rewrite function returned only a query object, with no mechanism to pass separated variable bindings to the executor. Without parameterization, the DQL parser cannot distinguish between developer-authored syntax and attacker-controlled data.

Attack Vector

Exploitation requires no authentication. An attacker sends a GraphQL request to the checkUserPassword endpoint containing a crafted password value with an embedded double-quote character followed by additional DQL query blocks. The injected DQL executes with the privileges of the resolver, allowing arbitrary read queries against protected predicates in the graph store.

// Security patch in graphql/resolve/query.go
// The QueryRewriter interface is refactored to return DQL variable bindings
// separately from the query, enabling parameterized password checks.

// A QueryRewriter can build a Dgraph dql.GraphQuery from a GraphQL query,
// along with any DQL variable bindings (e.g. for parameterized password
// queries) that must be supplied to the executor.
type QueryRewriter interface {
-	Rewrite(ctx context.Context, q schema.Query) ([]*dql.GraphQuery, error)
+	Rewrite(ctx context.Context, q schema.Query) ([]*dql.GraphQuery, map[string]string, error)
}

Source: GitHub Commit cee702c

The patched currentUserResolver.Rewrite function was updated to return a map[string]string of variable bindings alongside the query, allowing the executor to bind the password value as a parameter rather than embedding it in the DQL text.

Detection Methods for CVE-2026-44840

Indicators of Compromise

GraphQL requests to the checkUserPassword or login endpoints containing double-quote (") characters within the password field
Requests containing DQL keywords such as func:, uid(, eq(, or block delimiters ({, }) inside password parameters
Unusually large or structured password values submitted to Dgraph Alpha nodes
Repeated login attempts from a single source targeting different usernames with malformed password payloads

Detection Strategies

Inspect Dgraph Alpha access logs for GraphQL mutations and queries where the password field length or character set deviates from expected user credentials
Deploy a Web Application Firewall (WAF) rule that flags DQL syntax tokens appearing in authentication payloads before requests reach Dgraph
Correlate authentication failures with subsequent unauthorized data access patterns in application telemetry

Monitoring Recommendations

Enable verbose query logging on Dgraph Alpha nodes and forward logs to a centralized analytics platform for anomaly detection
Track the volume of checkUserPassword invocations and alert on sudden spikes or failed parse errors from the DQL engine
Monitor egress traffic from Dgraph hosts for unexpected data exfiltration following authentication events

How to Mitigate CVE-2026-44840

Immediate Actions Required

Upgrade Dgraph to version 25.3.4 or later, which introduces parameterized DQL variable bindings for password checks
Restrict network exposure of Dgraph Alpha endpoints to trusted application tiers only
Rotate credentials for any accounts that may have been queried while a vulnerable version was reachable

Patch Information

The fix is available in Dgraph release v25.3.4. Technical details are documented in GitHub Security Advisory GHSA-q2m9-6jp9-c6mc and the corresponding GitHub commit cee702c. The patch refactors the QueryRewriter interface to return DQL variable bindings separately, enabling the executor to bind the password as a parameter rather than concatenating it into the query string.

Workarounds

Place Dgraph behind a reverse proxy or API gateway that rejects password values containing double quotes or DQL syntax tokens
Disable or firewall the checkUserPassword GraphQL endpoint if ACL is not required by the application
Enforce strict allow-list validation of password character sets at the application layer before forwarding requests to Dgraph

bash

# Verify running Dgraph version and upgrade path
dgraph version

# Pull the patched release image
docker pull dgraph/dgraph:v25.3.4

# Restart Alpha nodes with the patched image
docker stop dgraph-alpha && \
  docker run -d --name dgraph-alpha dgraph/dgraph:v25.3.4 dgraph alpha