Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Date: 2026-06
Affected: go/github.com/dgraph-io/dgraph/v25
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44840
CWE: CWE-943
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

## Summary The `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. ## Details ### Vulnerable Code Path The vulnerability exists in the GraphQL-to-DQL query rewriting layer: 1. **`query_rewriter.go` (~line 364)** — The `checkpwd()` DQL function is constructed using `fmt.Sprintf`: ```go fmt.Sprintf(`checkpwd(User.password, "%s")`, password) ``` The raw password string from the GraphQL query input is embedded directly into the DQL query without escaping double quotes or other special characters. 2. **`graphquery.go`** — The constructed query attribute is serialized into the final DQL string via `b.WriteString(query.Attr)`, passing the unsanitized content directly to the Dgraph query engine. ### Attack Mechanism A password value containing a double-quote (`"`) terminates the string literal in the `checkpwd()` function. Any content after the escaped quote is parsed as additional DQL, allowing the attacker to inject arbitrary query blocks. ### Distinction from CVE-2026-41328 and CVE-2026-41327 CVE-2026-41328 and CVE-2026-41327 address DQL injection in **`edgraph/server.go`**, where GraphQL mutation inputs (upsert/delete) a


Mitigations:

Architectural layers (MAESTRO):