PkgSeer

Vulnerability GO-2026-5516

Unknown

2 months ago

Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8

Summary

Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph

Details

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

v25.0.0-custom-qt-improv-1 - v25.4.0-preview1 GHSA-qj98-gp63-54xj

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.4 GO-2026-6261

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.4 GO-2026-6261

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

v25.0.0-custom-qt-improv-1 - v25.3.4 GHSA-rrwh-6jrq-wp5v

Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8 GO-2026-5274

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

2 months ago

Fixed (v25.3.3)

5 months ago

Fixed (v24.1.8)

5 months ago

Last Modified

2 months ago