CVE-2026-102748 with a CVSS score of 9.2 is a critical missing-authentication vulnerability in the Dgraph Zero administrative HTTP component, affecting github.com/dgraph-io/dgraph/v25 (go) versions <= 25.3.8. The flaw occurs because Zero registers administrative HTTP endpoints directly without authentication or IP-whitelist protection when the administrative HTTP feature is enabled by default and port 6080 is reachable. Exposed routes include /state, /assign, /removeNode, and /moveTablet, allowing an unauthenticated remote attacker to read cluster topology and control-plane metadata, allocate identifiers, and invoke destructive membership operations. In a single-node standalone deployment, sending an unauthenticated request to /removeNode?id=1&group=0 causes the Zero control plane to break and leaves Alpha repeatedly failing to reconnect to localhost:5080. The attack requires no credentials, no user interaction, and only network access to the exposed administrative port. Business impact includes denial of service against the database control plane, disruption of cluster membership, loss of administrative visibility, and destabilization of dependent Alpha nodes, potentially interrupting data operations and increasing recovery effort.
We recommend you to update Dgraph to version 25.4.0.[/subscribe_to_unlock_form]
CVE-2026-102748 with a CVSS score of 9.2 is a critical missing-authentication vulnerability in the Dgraph Zero administrative HTTP component, affecting github.com/dgraph-io/dgraph/v25 (go) versions <= 25.3.8. The flaw occurs because Zero registers administrative HTTP endpoints directly without authentication or IP-whitelist protection when the administrative HTTP feature is enabled by default and port 6080 is reachable. Exposed routes include /state, /assign, /removeNode, and /moveTablet, allowing an unauthenticated remote attacker to read cluster topology and control-plane metadata, allocate identifiers, and invoke destructive membership operations. In a single-node standalone deployment, sending an unauthenticated request to /removeNode?id=1&group=0 causes the Zero control plane to break and leaves Alpha repeatedly failing to reconnect to localhost:5080. The attack requires no credentials, no user interaction, and only network access to the exposed administrative port. Business impact includes denial of service against the database control plane, disruption of cluster membership, loss of administrative visibility, and destabilization of dependent Alpha nodes, potentially interrupting data operations and increasing recovery effort.
We recommend you to update Dgraph to version 25.4.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]