Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M
CVE-2026-102748Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
Critical 9.2
In plain English
A critical-severity missing authentication in dgraph from dgraph-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/dgraph-io/dgraph/v25 | 25.4.0 | GHSA-qj98-gp63-54xj |
Affected products (as reported)
Weakness: CWE-306, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj x_refsource_CONFIRM
- https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1 x_refsource_MISC
- https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0 x_refsource_MISC