Description
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
Published: 2026-10-14
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in Dgraph Zero allows an unauthenticated attacker to send requests to a privileged administrative route that can remove cluster nodes. This causes a configuration change that destabilizes Alpha nodes and can lead to a denial of service in the control plane.

Affected Systems

Vendors impacted are dgraph-io dgraph, specifically any installation of the open‑source GraphQL database prior to the v25.4.0 release. The issue exists in all versions that register the /removeNode route on port 6080 without authentication, until the fix was released in v25.4.0.

Risk and Exploitability

The CVSS score of 9.2 reflects a high likelihood of successful exploitation when a host exposes the Zero HTTP port. The EPSS score is not available and the vulnerability is not yet in the CISA KEV catalog. An attacker only needs network reachability to Zero's HTTP port, which is unprotected and therefore the attack vector is straightforward for anyone who can contact it from the network.

Generated by OpenCVE AI on October 15, 2026 at 14:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch by upgrading to Dgraph dgraph v25.4.0 or higher.
  • If immediate upgrade is not possible, disable the Zero administrative interface or close port 6080 to all external traffic.
  • Configure network segmentation or firewall rules to restrict access to the Zero HTTP port only to trusted nodes, and monitor logs for unexpected /removeNode requests.

Generated by OpenCVE AI on October 15, 2026 at 14:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-qj98-gp63-54xj Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
History

Wed, 14 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
Title Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
Weaknesses CWE-306
CWE-862
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T15:06:27.332Z

Reserved: 2026-09-29T16:19:11.296Z

Link: CVE-2026-102748

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T19:17:05.700

Modified: 2026-10-15T16:17:32.450

Link: CVE-2026-102748

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T14:30:18Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-862

    Missing Authorization