CVE-2026-102748 in Dgraph
Summary
by MITRE • 10/14/2026
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
Dgraph serves as a prominent open-source distributed GraphQL database designed to handle large-scale data with high availability and consistency. Within its architecture, the Dgraph Zero component acts as the control plane, managing cluster membership, topology changes, and coordination among Alpha nodes that store actual data. A critical security flaw was identified in versions of Dgraph prior to 25.4.0 regarding the configuration of administrative HTTP routes on port 6080. When the administrative interface is enabled for operational purposes such as monitoring or management, these endpoints were registered without implementing any form of authentication mechanism. This design oversight creates a significant attack surface where remote unauthenticated actors who have network reachability to this specific port can interact directly with sensitive control plane functions.
The technical core of this vulnerability lies in the lack of access controls on several administrative endpoints exposed by Dgraph Zero. Specifically, routes such as /state allow an attacker to read the current cluster topology and internal state information. The /assign endpoint permits the allocation of identifiers that are critical for data distribution logic within the database. Furthermore, the /moveTablet route exposes functionality related to tablet migration, which is essential for load balancing but dangerous if misused by unauthorized parties. Most critically, the /removeNode endpoint accepts user-supplied id and group parameters and passes them directly into Server.RemoveNode. This function subsequently triggers ProposePeerRemoval when a specific condition involving group 0 is met. Because there is no authentication check preceding these operations, any remote entity can invoke these methods to manipulate cluster membership dynamics at will.
The operational impact of this vulnerability is severe, primarily centering on the destabilization of the entire Dgraph cluster. By leveraging the /removeNode endpoint with appropriate parameters, an attacker can forcibly remove nodes from the cluster control plane or disrupt Alpha node connectivity. This action effectively denies service to legitimate users by breaking the consensus mechanisms that maintain data consistency and availability. Additionally, the ability to read topology via /state and allocate identifiers through /assign allows for reconnaissance and potential manipulation of data distribution strategies, which could lead to further instability or information disclosure regarding the internal structure of the database deployment. Such actions can cause cascading failures across Alpha nodes that rely on Zero for coordination, potentially resulting in extended downtime and loss of service availability.
This vulnerability is classified under CWE-287, Improper Authentication, as it involves a failure to verify identity before granting access to administrative functions. In terms of the MITRE ATT&CK framework, this flaw facilitates Initial Access through exposed services and can be leveraged for Disruption or Denial of Service by manipulating cluster membership via techniques associated with Resource Hijacking or Infrastructure Impact. The exploitation path is straightforward given network accessibility, requiring no credentials but only valid HTTP requests to the specified endpoints on port 6080.
To mitigate this risk, organizations running Dgraph must ensure that they upgrade immediately to version 25.4.0 or later, where authentication checks have been implemented for these administrative routes. If upgrading is not immediately feasible, it is imperative to restrict network access to port 6080 using firewall rules so that only trusted management networks can reach the Dgraph Zero instance. Additionally, administrators should disable the administrative interface if it is not strictly required for daily operations, thereby reducing the attack surface entirely. Regular security audits and penetration testing of database infrastructure are recommended to identify similar misconfigurations in distributed systems where control planes may be inadvertently exposed to untrusted networks.