CVE-2026-41327 affects Dgraph, an open source distributed GraphQL database, in versions before 25.3.3. The vulnerability is due to improper neutralization of special elements in data query logic (CWE-943). Specifically, the cond field in an upsert mutation is concatenated directly into a DQL query string without proper escaping, parameterization, or structural validation. An attacker can inject additional DQL query blocks that the parser accepts as valid, resulting in execution of injected queries server-side and exposure of all database data in the HTTP response. This occurs in the default configuration where ACL is disabled. The vulnerability has a CVSS 3.1 score of 9.1 (critical).

An unauthenticated attacker can perform a single HTTP POST request with a crafted cond field to execute arbitrary DQL queries, gaining full read access to all data in the affected Dgraph database. This compromises confidentiality but does not affect integrity or availability. The impact is critical due to the ease of exploitation and the breadth of data exposure.

Upgrade Dgraph to version 25.3.3 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory details are provided, confirm patch availability from the vendor. If upgrading immediately is not possible, enable Access Control Lists (ACL) to restrict unauthenticated access as a temporary mitigation. Patch status is not yet confirmed from vendor advisory; check the vendor's official resources for current remediation guidance.