Key points
- Dgraph Zero versions before 25.4.0 expose administrative HTTP routes without authentication.
- Remote attackers can remove nodes and destabilise the cluster control plane.
- The vendor has released version 25.4.0 to fix the vulnerability.
Unauthenticated remote attackers can disrupt Dgraph database clusters by exploiting unprotected administrative routes in Dgraph Zero. The flaw allows adversaries to read topology, allocate identifiers and remove membership from the control plane without credentials.
According to the NVD record for CVE-2026-102748, Dgraph Zero registers these administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. This exposure affects versions prior to 25.4.0.
Technical details of the flaw
The vulnerability stems from missing capability checks in the route registration process within dgraph/cmd/zero/run.go. Attackers can use the /removeNode route to pass controlled id and group values to Server.RemoveNode.
Setting the group value to zero triggers ProposePeerRemoval. This action removes membership from the Zero control plane, which destabilises Alpha nodes that depend on Zero for coordination.
Affected systems
The issue affects Dgraph Zero, the coordination service for the open source distributed GraphQL database. Any deployment running versions earlier than 25.4.0 with the administrative interface enabled is vulnerable.
As Payload Report reported on 2026-10-14, similar missing capability checks have enabled unauthenticated admin account creation in other software. This pattern highlights the risk of exposed management interfaces.
What happens next
The vendor has released version 25.4.0 to address this issue. Users should update their Dgraph Zero installations to this version to restore proper authentication requirements for administrative routes.
Why this attack works
This incident illustrates the risk of exposing management interfaces without proper access controls. Attackers leverage unauthenticated endpoints to perform high-privilege actions like node removal. Teams usually secure such ports behind firewalls or require mutual TLS. Check whether your deployment restricts access to administrative ports to trusted networks only. Ensure that all management APIs enforce strict authentication before processing commands.
What to do and how to stay safe: Dgraph
- Update Dgraph Zero to version 25.4.0 or later to apply the vendor fix.
- Restrict network access to port 6080 to trusted management interfaces only.
- Monitor logs for unauthenticated requests to administrative endpoints.
- Verify that all database coordination services enforce authentication.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102748?
The NVD rates the vulnerability as Critical with a CVSS score of 9.2.
Which versions of Dgraph are affected?
All versions of Dgraph Zero prior to 25.4.0 are affected.
Is there a fix available?
Yes, the issue is fixed in version 25.4.0.
