CVE-2026-63637: 
Wolfi vulnerability analysis and mitigation

CVE-2026-63637 is a DQL (Dgraph Query Language) injection vulnerability in Dgraph, an open-source distributed GraphQL database. The flaw exists in the maybeQuoteArg function within graphql/resolve/query_rewriter.go, which passes regexp filter strings into generated DQL queries without validation or sanitization. All versions prior to 25.3.8 are affected. It was published on August 6, 2026, with a fix released in version 25.3.8. The vulnerability carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The root cause is classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic). In query_rewriter.go at line 2349, the maybeQuoteArg function explicitly returns regexp filter arguments raw — without any quoting or validation — when the function name is regexp. This raw value is then written verbatim into the DQL query string by writeFilterArguments in graphquery.go:185. An unauthenticated attacker can craft a GraphQL query with a regexp filter value that closes the regex literal (e.g., /x/i) OR has(User.name), causing the DQL lexer to tokenize the injected content as valid DQL syntax and execute attacker-controlled filter logic. The vulnerability affects any schema with at least one type using @search(by: [regexp]) or @search(by: [trigram]) on a String field, which is a common Dgraph configuration. The fix introduces an isValidRegexArg function that validates the /pattern/flags structure before allowing raw passthrough (GitHub Advisory, Fix Commit).

Successful exploitation enables unauthenticated attackers to bypass intended GraphQL query filters and retrieve all nodes of any type that has a regexp-indexed field, resulting in significant data disclosure. For mutations (which require user-level authentication), attackers can expand the scope of update and delete operations to target all nodes of a type rather than the intended subset, enabling mass data modification or deletion. The confidentiality impact is rated High, while integrity and availability impacts are rated Low, reflecting the ability to exfiltrate entire datasets and potentially corrupt or destroy data at scale (GitHub Advisory).

The vulnerability is network-exploitable with no authentication required for query-based attacks, no user interaction needed, and low attack complexity, making it highly automatable. NVD SSVC data classifies exploitation status as "poc" (proof-of-concept available), and the vulnerability is listed in the CISA vulnerability bulletin SB26-222. The EPSS score is approximately 0.0024 (0.24%), indicating currently low observed exploitation probability. No specific threat actor attribution or confirmed in-the-wild exploitation campaigns have been reported at this time (GitHub Advisory, CISA Bulletin).

1. Reconnaissance: Identify Dgraph instances exposed to the network (e.g., via Shodan searching for Dgraph's default GraphQL endpoint on port 8080). Confirm the target is running a version prior to 25.3.8.
2. Schema enumeration: Use GraphQL introspection queries to identify types with @search(by: [regexp]) or @search(by: [trigram]) directives on String fields, which are prerequisites for exploitation.
3. Craft injection payload: Construct a GraphQL query with a malicious regexp filter value that closes the regex literal and injects DQL operators. For example:

query {
  queryUser(filter: { name: { regexp: "/x/i) OR has(User.name" }}) {
    name
    email
  }
}

4. Send the request: Submit the crafted GraphQL query via HTTP POST to the Dgraph GraphQL endpoint (e.g., http://target:8080/graphql). No authentication token is required for query-based exploitation.
5. Observe injected DQL: The server generates DQL @filter(regexp(User.name, /x/i) OR has(User.name)), which matches all nodes of the type, returning all user records regardless of the intended filter.
6. Escalate to mutations (if authenticated): With user-level credentials, craft a similar injection in a deleteUser or updateUser mutation filter to expand the operation scope to all nodes of the type, enabling mass deletion or modification (GitHub Advisory).

• Network: Unusual HTTP POST requests to the Dgraph GraphQL endpoint (default port 8080, path /graphql) containing regexp filter values with patterns like /x/i) OR has(, uid(, or eq( embedded within the filter argument string.
• Logs: Dgraph query logs showing DQL queries with unexpected OR has(...), OR uid(...), or other boolean operators appended after a regexp() call; queries returning anomalously large result sets from a single filter operation.
• Application Behavior: Sudden spikes in data returned from GraphQL queries that use regexp filters; unexpected mass deletions or modifications affecting entire node types in the database.
• GraphQL Access Logs: Repeated requests from the same source IP with varying regexp filter payloads, indicative of automated injection probing (GitHub Advisory).

Upgrade Dgraph to version 25.3.8 or later, which introduces the isValidRegexArg validation function that ensures regexp filter arguments conform strictly to the /pattern/flags format before being passed to DQL verbatim. No official configuration-based workaround is provided; upgrading is the only recommended remediation. As an interim measure, operators can restrict network access to the Dgraph GraphQL endpoint to trusted clients only, and review @auth rules on sensitive types to limit the blast radius of injection-based filter bypasses (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher "zx (Jace)" and credited to "manus-use" in the GitHub Security Advisory. The advisory was published by Dgraph maintainer matthewmcneely on July 17, 2026. The CISA included the vulnerability in its weekly bulletin SB26-222, and it received brief coverage on Mastodon via The Hacker Wire. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory, CISA Bulletin).