Is CVE-2026-41327 actively exploited?

No active exploitation of CVE-2026-41327 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41327 be exploited remotely?

Yes. CVE-2026-41327 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41327?

CVE-2026-41327 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-41327

CRITICAL

CVE-2026-41327

CWE-943Published: April 24, 2026· Updated: Apr 28, 2026

9.1

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.0th

Official Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configuration where ACL is not enabled. The attack is a single HTTP POST to /mutate?commitNow=true containing a crafted cond field in an upsert mutation. The cond value is concatenated directly into a DQL query string via strings.Builder.WriteString after only a cosmetic strings.Replace transformation. No escaping, parameterization, or structural validation is applied. An attacker injects an additional DQL query block into the cond string, which the DQL parser accepts as a syntactically valid named query block. The injected query executes server-side and its results are returned in the HTTP response. This vulnerability is fixed in 25.3.3.

NVD Source

Technical Analysis

CVE-2026-41327 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.