Read the docs
TI-2026-74405 Aliases CVE-2026-102748GHSA-qj98-gp63-54xj

Unauthenticated admin HTTP routes in Dgraph Zero allow node removal

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Dgraph before 25.4.0 registers administrative HTTP routes on Dgraph Zero without authentication when the administrative interface is enabled. This missing authentication (CWE-306) lets a remote unauthenticated attacker who can reach the Zero HTTP port remove cluster members through the /removeNode route, which disrupts the Zero control plane and destabilizes dependent Alpha nodes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00615 49th percentileScored 2026-11-07
Fix Fixed dgraph (dgraph-io): 25.4.0github.com/dgraph-io/dgraph/v25 (Go): 25.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dgraph-iodgraphbefore 25.4.025.4.0Patch availableCNA
—github.com/dgraph-io/dgraph/v25 (Go)before 25.4.025.4.0Patch availableGHSA-qj98-gp63-54xj
  • dgraph Vendordgraph-io Affected before 25.4.0 Fixed in 25.4.0 Patch available CNA
  • github.com/dgraph-io/dgraph/v25 (Go) Vendor— Affected before 25.4.0 Fixed in 25.4.0 Patch available GHSA-qj98-gp63-54xj

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:*——dgraph-io
  • cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:* Versions — — ·dgraph-io

Remediation

Update the Go module github.com/dgraph-io/dgraph/v25 to version 25.4.0, which fixes this issue. The sources list no fixed version for dgraph.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dgraph (dgraph-io) Fixed in 25.4.0
  • Fix · GHSA-qj98-gp63-54xj github.com/dgraph-io/dgraph/v25 (Go) Fixed in 25.4.0 Advisory →

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-102748
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-qj98-gp63-54xj
  4. 2026-10-16 Fix available: Go/github.com/dgraph-io/dgraph/[email protected] · GHSA-qj98-gp63-54xj
  5. 2026-10-16 CVSS score added · GHSA-qj98-gp63-54xj
  6. 2026-10-16 Weakness changed · GHSA-qj98-gp63-54xj
  7. 2026-10-16 5 new references · GHSA-qj98-gp63-54xj

References

Advisory 1

Other 4

  • TI-2026-30079 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph CVSS 3.1CRITICAL 9.8
  • TI-2026-28987 Dgraph: Unauthenticated pprof endpoint leaks admin auth token CVSS 3.1CRITICAL 9.4
  • TI-2026-27198 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVSS 3.1CRITICAL 10.0
  • TI-2026-38995 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import CVSS 3.1CRITICAL 9.1
  • TI-2026-29929 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field CVSS 3.1CRITICAL 9.1
  • TI-2026-29928 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field CVSS 3.1CRITICAL 9.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences