Dgraph CVE-2026-63637

The Dgraph GraphQL API endpoint must be network-reachable by the attacker. The CVSS PR:N vector and the fix commit comment explicitly state that exploitation is possible without authentication when the endpoint is publicly accessible. The injection is triggered via a GraphQL regexp filter argument on any field annotated with a Dgraph search directive supporting regexp-based filtering (e.g., @search(by: ["trigram"])); no non-default server configuration is required. Exploitation for mutation or deletion impact additionally requires the attacker to issue mutation or deletion GraphQL operations against the endpoint. Limiting factors: (1) network inaccessibility - installations where the GraphQL port is firewalled or placed behind authenticated API gateway access are not directly exploitable by external attackers; (2) the attacker must enumerate a valid GraphQL type and field that exposes a regexp filter; (3) write-impact exploitation requires that mutations and deletions are permitted through the exposed API without further application-layer authorization controls.

The CVSS 8.6 High score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L is consistent with the technical evidence: the injection requires only a single crafted GraphQL request, no authentication, and no unusual configuration. The C:H rating is well-founded - an attacker can bypass intended predicate filters to retrieve all nodes of a queried type. The I:L and A:L ratings reflect that mutation and deletion operations can similarly expand beyond their intended targets. No EPSS data was provided, preventing quantitative probability comparison. The vulnerability is not listed in CISA KEV, so active exploitation is unconfirmed. The fix commit includes a working regression test payload (/x/) OR has(Country.name), which effectively constitutes a functional proof of concept embedded in the public repository - this lowers the bar for exploitation significantly even in the absence of a dedicated standalone PoC. The primary real-world risk limiter is deployment exposure: Dgraph installations where the GraphQL API port is not publicly reachable or is protected by API gateway authentication have substantially reduced exposure. For publicly exposed Dgraph GraphQL endpoints, this is a genuine high-priority issue requiring immediate patching.

An unauthenticated attacker sends a GraphQL query to the Dgraph API with a crafted regexp filter argument such as { name: { regexp: "/x/) OR has(Country.name" } }. Because maybeQuoteArg writes this value verbatim into the generated DQL, the payload closes the intended regexp() call and appends OR has(Country.name), causing the query to match and return every node of the queried type rather than only the intended subset. A working test payload demonstrating this exact behavior is included in the public fix commit, confirming exploitation requires no special tooling beyond a standard HTTP client and knowledge of the target GraphQL schema.