CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
Unauthenticated attackers can exfiltrate all database data via DQL injection in the upsert condition field when ACL is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41327?
CVE-2026-41327 is a critical code injection vulnerability in dgraph-io dgraph, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3.
Weakness: CWE-943
Which versions are affected by CVE-2026-41327?
9 open source packages ship an affected version, including github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 and github.com/dgraph-io/dgraph/v25. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph Go | All versions | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.8 | None |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
3 more packages
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
github.com/hypermodeinc/dgraph/v24 Go | All versions | 24.1.8 |
Products include Dgraph Dgraph.
How do I fix CVE-2026-41327?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41327 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41327 exists.
Other vulnerabilities in dgraph-io dgraph
- CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
- CVE-2026-40173 Dgraph: Unauthenticated pprof endpoint leaks admin auth token
- CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
- CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse
Sources
Also known as GHSA-mrxx-39g5-ph77, GO-2026-5516.