CVE-2026-41327 - Vulnerability Analysis

Overview

Dgraph < 25.3.3 contains an injection vulnerability caused by unsanitized 'cond' field in upsert mutation, letting unauthenticated attackers read all data in default ACL-disabled configuration via crafted HTTP POST.

Severity & Score

Impact

Unauthenticated attackers can read all data in the database, leading to full data disclosure.

Mitigation

Update to version 25.3.3 or later.

References

• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3
• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-mrxx-39g5-ph77

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner