CVE-2026-102748

Deferred Deferred - Pending Action

Unauthenticated Admin Access in Dgraph Zero

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102748

EUVD

EUVD-2026-101603

Affected Vendors & Products

Vendor	Product	Version / Range
dgraph-io	dgraph	< 25.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-102748 is a critical unauthenticated Denial of Service (DoS) vulnerability in Dgraph versions up to 25.3.8. Dgraph Zero exposes administrative HTTP endpoints on port 6080 without authentication. Attackers can exploit endpoints like /removeNode to disrupt the Zero control plane, causing Alpha nodes to fail reconnecting and leading to a DoS. The flaw allows reading cluster metadata, allocating IDs, and unauthorized membership actions.

Detection Guidance

Check if Dgraph Zero is running on port 6080 without authentication. Use curl to test unauthenticated access to administrative endpoints like /state, /assign, /removeNode, or /moveTablet. Example: curl http://<target>:6080/state. If responses contain cluster metadata without requiring credentials, the system is likely vulnerable.

Impact Analysis

An attacker can remotely exploit this vulnerability to disrupt your Dgraph cluster operations. This may cause service outages, data unavailability, or unauthorized changes to cluster membership. The impact includes potential data loss, service degradation, and compromised cluster integrity.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and availability principles or HIPAA's security requirements. It may result in non-compliance due to potential exposure of sensitive data and disruption of critical services.

Mitigation Strategies

Upgrade Dgraph to version 25.4.0 or later. If upgrading is not immediately possible, disable the administrative HTTP interface on port 6080 or restrict access via firewall rules to trusted IPs only. Enable authentication using the --security flag with token or whitelist options as described in the patch notes.

Hi! I’m here to help you understand CVE-2026-102748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70