Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-54061Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Critical 9.1

In plain English

A critical-severity missing authentication in dgraph from dgraph-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 59.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/dgraph-io/dgraph	no fix listed	GO-2026-6261
Go	github.com/dgraph-io/dgraph/v25	25.3.5	GHSA-rrwh-6jrq-wp5v
Go	github.com/dgraph-io/dgraph/v25	25.3.5	GO-2026-6261

Affected products (as reported)

Vendor	Product	Versions
dgraph-io	dgraph	< 25.3.5

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v x_refsource_CONFIRM
https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 x_refsource_MISC