CVE-2026-63637 dgraph-io CVE debrief

Who should care

Users of Dgraph, especially those who use GraphQL query and mutation filters, should be aware of this vulnerability and take steps to address it. This includes verifying Dgraph installations, reviewing GraphQL query and mutation filters, and implementing compensating controls such as monitoring and exception tracking to detect potential exploitation attempts. Dgraph users with GraphQL query and mutation filters should prioritize upgrading to version 25.3.8 or later to address the vulnerability and review their filters to prevent DQL operator injection attacks. Security teams and vulnerability management teams should also be aware of this vulnerability and track exceptions and retest remediated assets to ensure that the vulnerability is properly addressed. Additionally, operators and platform administrators should review the vulnerability and take steps to mitigate potential impact, including implementing compensating controls and monitoring for potential exploitation attempts. Security teams should also review and restrict GraphQL query and mutation filters to prevent injection of DQL operators and ensure that Dgraph installations are properly configured and secured. This vulnerability may impact Dgraph users who rely on GraphQL query and mutation filters, and they should take steps to address the vulnerability and prevent potential exploitation attempts. Dgraph users should also consider implementing additional security controls, such as asset inventory and rollback/change windows, to mitigate potential impact. Vulnerability management teams should prioritize addressing this vulnerability and track exceptions and retest remediated assets to ensure that the vulnerability is properly addressed. Security teams and operators should also review and implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts. This vulnerability may impact Dgraph users who rely on GraphQL query and mutation filters, and they should take steps to address the vulnerability and prevent potential exploitation attempts. Dgraph users should also consider implementing additional security controls, such as asset inventory and rollback,

Technical summary

The maybeQuoteArg function in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8. Users should review and restrict GraphQL query and mutation filters to prevent injection of DQL operators.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets.

Recommended defensive actions

• Inventory and verify Dgraph installations to identify potential exposure
• Upgrade to Dgraph version 25.3.8 or later to address the vulnerability
• Implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts
• Review and restrict GraphQL query and mutation filters to prevent injection of DQL operators
• Track exceptions and retest remediated assets to ensure that the vulnerability is properly addressed
• Review and implement compensating controls, such as monitoring and exception tracking, to detect potential exploitation attempts
• Consider implementing additional security controls, such as asset inventory and rollback/change windows, to mitigate potential impact

Evidence notes

Evidence from the NVD and CVE.org indicates that Dgraph, an open source distributed GraphQL database, has a vulnerability prior to version 25.3.8. The maybeQuoteArg function in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form. Limited source detail suggests verifying Dgraph installations, reviewing GraphQL query and mutation filters, and monitoring for potential exploitation attempts.

Official resources