CVE-2026-44840

HighCVSS 7.5/10Last modified Jul 9, 2026

Description

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-943

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Jul 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-448438.2LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code CVE-2026-448446.3eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed informa CVE-2026-448456.7JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated adminis CVE-2026-448466.2JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.in CVE-2026-448477.5MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id})CVE-2026-448488.8Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448498.8Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-44856.3A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin CVE-2026-448508.5Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swa CVE-2026-448527.2An authenticated remote code execution vulnerability exists in the AOS-8 and AOS-10 web-based management interface. A vulnerability in the c CVE-2026-448537.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation CVE-2026-448547.2Command injection vulnerabilities exist in the web-based management interface of AOS-8 and AOS-10 Operating Systems. Successful exploitation