CVE-2026-44840: Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

June 29, 2026

The checkUserPassword GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL checkpwd() query via fmt.Sprintf without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

References

github.com/advisories/GHSA-q2m9-6jp9-c6mc
github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac
github.com/dgraph-io/dgraph/releases/tag/v25.3.4
github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc
nvd.nist.gov/vuln/detail/CVE-2026-44840

Code Behaviors & Features

Detect and mitigate CVE-2026-44840 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →