CVE-2026-54061 PUBLISHED

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Assigner: GitHub_M
Reserved: 11.06.2026 Published: 08.07.2026 Updated: 08.07.2026

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiver calls Prepare() before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor dgraph-io
Product dgraph
Versions
  • Version < 25.3.5 is affected

References

Problem Types

  • CWE-306: Missing Authentication for Critical Function CWE