Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Disclosure1 |
| 2026-04-25 | 1 | Disclosure1 |
| 2026-04-27 | 1 | Patch1 |
🚨 Dgraph alert CVE-2026-41327 → DQL injection = unauthorized data access ⚠️ Patch now & enable ACL. https://vulert.com/vuln-db/CVE-2026-41327 #CyberSecurity #Dgraph #Vulert https://t.co/sXtwpG6sLp
Post summary
The tweet primarily alerts to CVE‑2026‑41327, classifying it as a DQL injection that permits unauthorized data access, and urges users to patch and enable ACL for protection.
CVE-2026-41327 Unauthenticated Query Injection in Dgraph Prior to Versio... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41327 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-41327, a query‑injection vulnerability in Dgraph prior to certain versions, providing a link to a vulnerability detail page but no proof–of‑concept, exploit, or mitigation information.
CVE-2026-41327 Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read acce… https://www.cve.org/CVERecord?id=CVE-2026-41327
Post summary
The text announces the discovery of a vulnerability in Dgraph that allows unauthenticated full read access, implying a patch exists in version 25.3.3, but it does not mention PoC, exploit code, or active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dgraph | dgraph | - | go | - |