GO-2026-5516
Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph
At a glance
- Published
- Updated
- CVE
- CVE-2026-41327
- Aliases
- GHSA-mrxx-39g5-ph77
Description
A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database. The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.3 |
| Go · github.com/hypermodeinc/dgraph/v24 | introduced 0, fixed 24.1.8 |
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77 ADVISORY
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |