CVE-2026-44840 Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
Attackers can inject arbitrary DQL queries via the checkUserPassword GraphQL query, potentially executing code or reading data in Dgraph databases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44840?
CVE-2026-44840 is a high-severity code injection vulnerability in dgraph-io dgraph, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.
Weakness: CWE-943
Which versions are affected by CVE-2026-44840?
5 open source packages ship an affected version, including github.com/dgraph-io/dgraph/v25, github.com/dgraph-io/dgraph and github.com/hypermodeinc/dgraph/v24.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.4 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.4 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.4 |
github.com/dgraph-io/dgraph Go | All versions | None |
github.com/hypermodeinc/dgraph/v24 Go | All versions | None |
How do I fix CVE-2026-44840?
Upgrade github.com/dgraph-io/dgraph/v25 to 25.3.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44840 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44840 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-q2m9-6jp9-c6mc, GO-2026-5837.