Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port 9080 without authentication or authorization, a missing‑authentication flaw identified as CWE‑306. An unauthenticated network client can open the StreamExtSnapshot RPC and send Badger stream data to the target group’s store. Because the receiver calls Prepare() before processing the stream, the existing database is deleted and replaced with the supplied data. This allows the attacker to overwrite all database contents, potentially destroying legitimate data.

prior to version 25.3.5, as identified by the vendor dgraph-io:dgraph. Any instance that exposes gRPC port to a network that an attacker can reach is susceptible. The affected versions are the pre‑25.3.5 releases of Dgraph Alpha.

The CVSS score of 9.1 indicates a high‑severity vulnerability that requires only network connectivity to the gRPC port and the ability to send a Badger snapshot; no additional secrets or privileged access are needed. Because the RPC is exposed without authentication, it can be used to replace the database with arbitrary data. The EPSS score of less than 1 % shows that exploitation is considered unlikely, but if the service is reachable, the lack of authentication still allows the attack.