CVE-2026-54061
CriticalCVSS 9.1Summary
Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.
Risk Assessment
An attacker can remotely overwrite the entire Dgraph database without authentication, leading to data loss or injection of malicious data, compromising system integrity and availability.
Recommendation
Immediately upgrade Dgraph to version 25.3.5 or later. If upgrading is not possible, restrict access to port :9080 via firewall or authentication.
Original NVD description (English source)
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.