CVE-2026-41327: 
NixOS vulnerability analysis and mitigation

CVE-2026-41327 is a DQL injection vulnerability in Dgraph titled "Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field." It allows unauthenticated attackers to exfiltrate the entire database contents via a single crafted HTTP POST request to the /mutate?commitNow=true endpoint. Affected versions include all Dgraph v25 releases prior to 25.3.3, all v24 releases (≤24.1.8), and all v1.x releases (≤1.2.8); the vulnerability is present in Dgraph's default configuration where ACL is disabled. The advisory was published on April 22, 2026, and assigned CVE-2026-41327 on April 24, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Dgraph Advisory).

The root cause is CWE-943 (Improper Neutralization of Special Elements in Data Query Logic), specifically in the buildUpsertQuery function at edgraph/server.go lines 714–757. The cond field from an upsert mutation JSON body is extracted via strconv.Unquote (which converts \n to real newlines) and then passed through only a cosmetic strings.Replace that swaps @if for @filter — no escaping, parameterization, or structural validation is applied before the value is concatenated directly into the DQL query string via strings.Builder.WriteString. An attacker crafts a cond value that closes the intended @filter(...) clause and appends a new named DQL query block (e.g., leak(func: has(dgraph.type)) { uid name email secret }); the DQL parser accepts this as syntactically valid, executes all query blocks, and returns results in the HTTP response. No authentication is required in the default configuration because authorizeQuery and authorizeMutation in edgraph/access.go both return nil immediately when AclSecretKey is not set; even with ACL enabled, a mutation-only user can inject read queries that bypass per-predicate authorization (Github Advisory, Dgraph Advisory).

Successful exploitation grants an unauthenticated attacker full read access to every node and predicate in the Dgraph database in a single HTTP request, enabling exfiltration of PII (names, emails, SSNs), application secrets (API keys), and cloud credentials (AWS access keys, GCP service account keys). Integrity is also impacted because the injection can be used to manipulate upsert conditions, bypassing uniqueness constraints and conditional mutation logic. Availability is not directly affected, as the attack is a pure read operation that does not modify or delete data. Exfiltrated cloud credentials could enable lateral movement into AWS or GCP environments beyond the Dgraph instance itself (Github Advisory, Dgraph Advisory).

A public proof-of-concept (poc.py) and a screen recording of the full attack are included in the official security advisory, along with step-by-step reproduction instructions using curl commands (Dgraph Advisory). The exploit requires no credentials, no prior access, and no user interaction — a single HTTP POST is sufficient against any default-configured Dgraph instance. As of the advisory publication date, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported (Github Advisory). The EPSS score is approximately 0.073% (22nd percentile), and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing Dgraph Alpha instances (default port 8080) using tools like Shodan or Censys, targeting versions ≤25.3.2. Confirm reachability with curl http://TARGET:8080/health.
2. Verify unauthenticated access: Confirm the /mutate endpoint requires no authentication by sending a benign POST and observing an HTTP 200 response with no auth challenge.
3. Craft the injection payload: Construct a JSON body where the cond field closes the intended @filter clause and appends a new DQL query block. Example:

{
  "query": "{ q(func: uid(0x1)) { uid } }",
  "mutations": [{
    "set": [{"uid": "0x1", "dgraph.type": "Dummy"}],
    "cond": "@if(eq(name, \"nonexistent\"))\n leak(func: has(dgraph.type)) { uid dgraph.type name email secret aws_access_key_id aws_secret_access_key gcp_service_account_key }"
  }]
}

4. Send the exploit request: POST the payload to http://TARGET:8080/mutate?commitNow=true with Content-Type: application/json and no authentication headers.
5. Receive exfiltrated data: Parse the HTTP 200 response; the data.queries.leak array contains all matching database nodes with all requested predicates, including secrets and credentials. The @if condition evaluates to false, so no data is written to the database.
6. Escalate with exfiltrated credentials: Use any recovered AWS keys, GCP service account keys, or API tokens to pivot into cloud environments or downstream services (Dgraph Advisory, Github Advisory).

• Network: Unexpected HTTP POST requests to /mutate?commitNow=true on port 8080 from external or untrusted IP addresses; response bodies containing a data.queries key with a non-standard named query block (e.g., leak) alongside the expected q result.
• Logs: Dgraph Alpha access logs showing POST /mutate?commitNow=true requests with unusually large cond field values containing newline characters or additional query block syntax; HTTP 200 responses to unauthenticated mutation requests from unknown clients.
• Application Behavior: Mutation requests that return query results for predicates not explicitly queried in the query field of the request body; presence of data.queries.<custom_alias> keys in mutation responses.
• File System: Presence of poc.py or LEAD_001_DQL.zip on attacker-controlled systems (if investigating a specific incident); unexpected docker-compose files referencing Dgraph with --security whitelist=0.0.0.0/0 in deployment environments (Dgraph Advisory).

The primary remediation is to upgrade Dgraph to version 25.3.3 or later, which addresses CVE-2026-41327 along with CVE-2026-41328 and CVE-2026-41492 (Dgraph Release). For v24 and v1.x users, no patched version is currently listed in the advisory; upgrading to v25.3.3 is recommended. As temporary mitigations: (1) enable ACL (AclSecretKey) to require authentication on the /mutate endpoint, though note this does not fully prevent the vulnerability for users with mutation permissions; (2) apply network-level firewall rules to restrict access to port 8080 to trusted IP ranges only; (3) avoid exposing the Dgraph Alpha HTTP port to untrusted networks (Github Advisory). The long-term fix requires buildUpsertQuery to parse the cond value via the DQL lexer and construct the @filter as a parsed AST subtree rather than raw string concatenation (Dgraph Advisory).

The Hacker Wire published coverage of the vulnerability shortly after disclosure, highlighting the critical unauthenticated nature of the attack (The Hacker Wire). A detailed technical write-up was also published by Infinitsec (Infinitsec). Social media activity was noted on Mastodon and Bluesky, with the vulnerability receiving attention from the security community given its pre-authentication, single-request exploitation profile and the inclusion of a working PoC in the official advisory.