CVE-2026-73976
Received Received - Intake

SPARQL Injection in djehuty Research Data Repository

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: GitHub, Inc.

Description
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-73976
EUVD
EUVD-2026-90967

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
4tu_researchdata djehuty to 26.3.2 (exc)
4tu_researchdata djehuty 26.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SPARQL injection flaw in the djehuty data repository system affecting versions before 26.3.2. An unauthenticated attacker can inject malicious SPARQL queries through three parameters (order, operator, key) in search/listing endpoints. This allows unauthorized data access across different graphs or denial-of-service attacks by submitting expensive queries.

Detection Guidance

Check for unusual SPARQL queries in logs, particularly to endpoints /v2/*/search and /v3/*/listing. Monitor for excessive query times or errors indicating malformed SPARQL syntax. Inspect network traffic for requests containing suspicious parameters like order, operator, or key with SPARQL keywords.

Impact Analysis

An attacker could steal private or draft data stored in the system by exfiltrating it through crafted queries. They could also crash the service by submitting resource-intensive queries, disrupting normal operations. No user account or interaction is required for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It risks breaches of personal or sensitive data, potentially resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade to djehuty version 26.3.2 or later. Apply input validation to restrict sortable column names, validate operators against a fixed set, and ensure the key parameter follows safe SPARQL variable naming. Block or monitor requests to /v2/*/search and /v3/*/listing endpoints for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart