Dgraph is an open‑source distributed GraphQL database that, before version 25.3.5, exposes the remote procedure calls used for external snapshot import on the public gRPC port 9080 without authentication or authorization (CWE‑306). A remote attacker can call the StreamExtSnapshot RPC and stream Badger snapshot data. Because the server performs a Prepare operation that deletes the existing database before ingesting the new stream, the attacker can overwrite the entire dataset. The vulnerability enables a full data replacement, creating severe integrity and availability impact.

Any instance of Dgraph Alpha running a version older than 25.3.5 and exposing the gRPC port to a network that an attacker can reach is affected. This includes deployments that have the default 9080 port accessible from external networks or from any internal network segment the attacker can access.

The CVSS score of 9.1 indicates a high severity vulnerability that requires only network connectivity to the exposed gRPC port and the ability to send a Badger snapshot; no credentials or privileged access are needed. The EPSS score of less than 1 % suggests that exploitation is considered unlikely at present, but the lack of authentication makes the attack possible whenever the service is reachable. The likely attack vector is inferred to be a remote network connection to the gRPC port, since no specialized local privilege or user interaction is required.