CVE-2026-54061

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.5

Description Dgraph Alpha exposes privileged RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. An unauthenticated network client can access the StreamExtSnapshot endpoint to send Badger stream data to the target group store. Because the receiver executes the Prepare() function before processing the stream, this operation deletes and replaces the existing database data, leading to full database destruction, service outages, and data loss.

Recommendations Update to version 25.3.5.