CVE-2026-41328

The attack requires sending two HTTP POST requests to port 8080. The first request, directed to the /alter endpoint, creates a schema predicate with attributes @unique @index(exact) @lang — which is possible without authentication in the default configuration. The second request sends a crafted JSON mutation to /mutate?commitNow=true, where the JSON key contains the predicate name, the @ character, and an injection payload inserted in the 'language tag' field. The vulnerable addQueryIfUnique function in edgraph/server.go constructs DQL queries using fmt.Sprintf without sanitizing the predicateName value, which contains the raw value of pred.Lang. The Lang field comes from the JSON mutation keys and is extracted by x.PredicateLang() by splitting on the @ character, never undergoing any validation. The attacker injects a closing parenthesis to escape the eq() function, adds any query block, and using the # comment character neutralizes the rest of the template syntax — the injected query is executed on the server side, and its results are returned in the HTTP response.

An unauthenticated attacker can read all data stored in the Dgraph database. The data confidentiality breach is complete, with no impact on integrity and availability.

Update Dgraph to version 25.3.3 or later, where the vulnerability has been fixed. As an interim security measure, consider enabling the ACL mechanism and restricting network access to port 8080 to trusted hosts only.

Dgraph in versions earlier than 25.3.3, running in the default configuration with ACL mechanism disabled.