EUVD-2026-54255Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Network-reachable GraphQL endpoint with no authentication per vendor commit; C:H for full type-level node disclosure, I:L and A:L for partial expansion of mutation and deletion targets.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.
AnalysisAI
NoSQL injection in Dgraph prior to 25.3.8 enables unauthenticated remote attackers to inject DQL operators through unvalidated regexp filter arguments in GraphQL queries and mutations, bypassing intended node-level access controls. The maybeQuoteArg function in graphql/resolve/query_rewriter.go writes regexp arguments verbatim into generated DQL without validating the /pattern/flags structure, allowing a crafted filter value like /x/) OR has(pred to close the regexp call and append attacker-controlled DQL expressions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Dgraph GraphQL API endpoint must be network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.6 High score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L is consistent with the technical evidence: the injection requires only a single crafted GraphQL request, no authentication, and no unusual configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Dgraph 25.3.8 or later, the vendor-confirmed fixed version documented in GHSA-33p8-wc97-5qcj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dgraph instances in your environment, document their versions, and identify which are exposed to the internet or untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today