Unauthenticated Data Replacement in Dgraph Alpha

Compliance Impact

CVE-2026-54061 allows unauthenticated attackers to delete or replace database data in Dgraph Alpha, potentially leading to data loss or unauthorized data modification.

Such unauthorized data manipulation can impact the integrity and availability of sensitive information, which are critical aspects of compliance with standards like GDPR and HIPAA.

In deployments with Access Control Lists (ACLs), the vulnerability could also lead to privilege escalation, further risking unauthorized access to protected data.

Therefore, this vulnerability could cause non-compliance with regulations that require strict data protection, access control, and data integrity safeguards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-54061 is a critical vulnerability in Dgraph Alpha versions 25.3.4 and earlier where the external snapshot import RPCs, including StreamExtSnapshot, are exposed on the public gRPC port :9080 without any authentication or authorization.

This allows an unauthenticated attacker to send Badger stream data to a target group’s store. When the receiver processes this stream, it calls a Prepare() operation that deletes and replaces the existing database data.

As a result, an attacker can delete or replace the database contents, potentially causing data loss or injecting attacker-controlled data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including complete loss or replacement of your database data without any authentication.

In deployments with Access Control Lists (ACLs) enabled, an attacker could replace group 1, which stores ACL and internal predicates, potentially leading to privilege escalation.

Overall, it compromises data integrity and availability, allowing attackers to disrupt or take control of your database.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the exposure of Dgraph Alpha's external snapshot import RPCs on the public gRPC port :9080 without authentication or authorization.

To detect this vulnerability on your network or system, you can check if the gRPC port 9080 is open and accessible from untrusted networks.

You may use network scanning tools or commands such as:

• nmap -p 9080 --open <target-ip> # To check if port 9080 is open
• grpcurl -plaintext <target-ip>:9080 list # To list exposed gRPC services on port 9080
• grpcurl -plaintext <target-ip>:9080 describe # To describe the RPC methods exposed

If you observe that the StreamExtSnapshot RPC or other snapshot import RPCs are accessible without authentication, your system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Dgraph Alpha to version 25.3.5 or later, where this vulnerability is patched.

If upgrading immediately is not possible, restrict network access to the gRPC port 9080 to trusted clients only, for example by firewall rules or network segmentation.

Additionally, implement administrator authorization checks and gRPC stream interceptors to enforce authentication and authorization on snapshot import operations.

Avoid exposing the gRPC port 9080 publicly until the patch is applied.

Useful 0 Not Useful 0