CVE-2026-63637

Received Received - Intake

DQL Injection in Dgraph Database

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-63637

Affected Vendors & Products

Vendor	Product	Version / Range
dgraph	dgraph	25.3.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

Executive Summary

Dgraph before version 25.3.8 has a flaw in the graphql/resolve/query_rewriter.go file where the maybeQuoteArg function does not properly handle regexp filter strings. This allows attackers to inject DQL operators into GraphQL queries or mutations by crafting filter patterns. The issue arises because the /pattern/flags form is not validated or quoted before being passed to generated DQL, enabling unintended data exposure or modifications.

Impact Analysis

This vulnerability could allow attackers to bypass intended access controls in Dgraph databases. They might disclose sensitive data by querying unintended nodes, modify or delete data beyond their permissions, or execute unauthorized operations. Systems using Dgraph versions before 25.3.8 are at risk of such attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable Dgraph versions may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Dgraph to version 25.3.8 or later to address the vulnerability in graphql/resolve/query_rewriter.go that allows filter injection via crafted GraphQL queries.

Hi! I’m here to help you understand CVE-2026-63637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70