CVE-2026-41327: Dgraph GraphQL Database Critical Unauthenticated Data Read

A critical vulnerability, CVE-2026-41327, has been identified in Dgraph, an open-source distributed GraphQL database. The National Vulnerability Database reports that prior to version 25.3.3, an unauthenticated attacker can achieve full read access to all data within the database. This exploit leverages Dgraph’s default configuration where Access Control Lists (ACLs) are not enabled, making many deployments vulnerable out-of-the-box.

The attack vector involves a single HTTP POST request to /mutate?commitNow=true containing a specially crafted cond field within an upsert mutation. The National Vulnerability Database explains that the cond value is directly concatenated into a DQL query string, lacking proper escaping, parameterization, or structural validation. This allows an attacker to inject an additional DQL query block, which the parser accepts and executes server-side, returning its results in the HTTP response. This flaw, classified as CWE-943, carries a CVSS score of 9.1 (CRITICAL).

This is a severe data exposure risk. Defenders must understand that the simplicity of the attack, coupled with its unauthenticated nature and critical impact, makes Dgraph instances without ACLs a prime target. The fix is available in Dgraph version 25.3.3, and immediate patching is non-negotiable for anyone running earlier versions.