PT-2026-113943 · Dgraph Io+2 · Dgraph+1
CVE-2026-102748
·
Published
2026-10-14
·
Updated
2026-10-15
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Dgraph versions prior to 25.4.0
Description
Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port can disrupt the Zero control plane and destabilize Alpha nodes. This is achieved by interacting with the following endpoints:
- '/state' to read topology
- '/assign' to allocate identifiers
- '/moveTablet' for administrative access
- '/removeNode' to remove membership, which accepts
idandgroupvariables and passes them to theServer.RemoveNode()function, wheregroup0 can triggerProposePeerRemoval().
Recommendations
Update to version 25.4.0.
As a temporary mitigation, restrict access to the Zero HTTP port 6080 or disable the administrative interface.
Exploit
Fix
Missing Authorization
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dgraph
Github.Com/Dgraph-Io/Dgraph/V25