Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-54061 EUVD-2026-42235GHSA-rrwh-6jrq-wp5vGO-2026-6261

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Published Jul 8, 2026 · Updated Jul 8, 2026 · Assigned by GitHub_M

Description

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Affected products

VendorProductAffectedFixed
dgraph-io dgraph < 25.3.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
SLES 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 SUSE-SU-2026:23625-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260827T195228-160000.1.1 openSUSE-SU-2026:21761-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/dgraph-io/dgraph all versions — GO-2026-6261
Go github.com/dgraph-io/dgraph/v25 < 25.3.5 25.3.5 GHSA-rrwh-6jrq-wp5v

Advisories 2

References