CVE-2026-63637highCWE-943

CVE-2026-63637: falha de alta gravidade em dgraph-io dgraph

Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dgraph

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
dgraph-io · dgraph
CVEs relacionadas — dgraph-io dgraph

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41492CRITICALUnauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in DgraphEPSS 3.1%CVE-2026-34976CRITICALDgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing AuthorizationEPSS 2.1%CVE-2026-102748CRITICALDgraph: Zero Unauthenticated HTTP Admin removeNode Denial of ServiceEPSS 0.6%CVE-2026-44840HIGHDgraph Vulnerable to DQL Injection via checkUserPassword GraphQL QueryEPSS 0.5%CVE-2026-40173CRITICALDgraph: Unauthenticated pprof endpoint leaks admin auth tokenEPSS 0.5%CVE-2026-41327CRITICALDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldEPSS 0.5%