GO-2026-5516

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5516

Import Source

https://vuln.go.dev/ID/GO-2026-5516.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5516

Aliases

Published

2026-08-11T20:19:48Z

Modified

2026-08-11T20:45:07.509353546Z

Summary

Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph

Details

A DQL injection vulnerability in Dgraph allows an unauthenticated remote attacker to exfiltrate data from the database.

The injection occurs via the "cond" field in upsert mutations. The buildUpsertQuery function fails to properly validate the condition string, allowing an attacker to craft a payload that closes the intended @if clause and appends arbitrary DQL query blocks. These injected blocks execute with the privileges of the Dgraph process, potentially leading to full database exfiltration.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5516",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/edgraph",
            "symbols": [
                "Server.Query"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5516.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.3.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25/edgraph",
            "symbols": [
                "Server.Query"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5516.json"

Go / github.com/hypermodeinc/dgraph/v24

Package

Name: github.com/hypermodeinc/dgraph/v24; View open source insights on deps.dev
Purl: pkg:golang/github.com/hypermodeinc/dgraph/v24

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.1.8

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hypermodeinc/dgraph/v24/edgraph",
            "symbols": [
                "Server.Query"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5516.json"