Key points
- Dgraph Zero versions before 25.4.0 expose administrative HTTP routes on port 6080 without authentication.
- Attackers can remove nodes or move tablets, destabilising Alpha nodes that depend on Zero.
- The vulnerability is fixed in Dgraph Zero version 25.4.0.
Dgraph Zero versions prior to 25.4.0 contain a critical flaw allowing unauthenticated remote attackers to disrupt database clusters. The vendor has released version 25.4.0 to address this issue, which exposes administrative control plane functions without requiring credentials.
What happened
Dgraph is an open-source distributed GraphQL database that relies on a control plane component known as Zero. According to the NVD record for CVE-2026-102748, versions of Dgraph Zero before 25.4.0 register administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. This configuration allows any remote user who can reach the port to interact with sensitive cluster management functions. The vulnerability is rated critical with a CVSS score of 9.2.
The flaw stems from how Dgraph Zero handles route registration in the source file dgraph/cmd/zero/run.go. An attacker can use the /state endpoint to read the current cluster topology. They can also use the /assign endpoint to allocate identifiers within the system. These actions provide visibility and initial foothold before more disruptive operations are attempted.
More dangerous actions include accessing the /moveTablet administrative route or using the /removeNode route. The /removeNode endpoint accepts attacker-controlled id and group values and passes them directly to Server.RemoveNode. If an attacker specifies group 0, this triggers ProposePeerRemoval. This allows a remote unauthenticated attacker to forcibly remove membership from the cluster.
Why it matters
This issue directly impacts the stability of the entire Dgraph cluster architecture. Zero acts as the central coordinator for the database, and Alpha nodes depend on Zero for consistent operation. Disrupting the Zero control plane can destabilise these dependent Alpha nodes.
The ability to remove nodes or move tablets without authentication gives attackers full control over cluster membership and data distribution. This can lead to service outages, data inconsistency, or complete cluster failure. The weaknesses are classified as CWE-306 and CWE-862, highlighting the authentication bypass and missing authorisation issues.
What happens next
Organisations must verify their current Dgraph Zero version immediately. If running any version before 25.4.0, they should plan an urgent upgrade. Security teams should check network access controls for port 6080 to limit exposure while upgrading. Monitor cluster logs for unexpected node removal or tablet movement events.
Patch priority
Teams should prioritise updating Dgraph Zero instances that are exposed to untrusted networks or the internet. Check whether port 6080 is accessible from outside the internal network. Test the upgrade process in a non-production environment first to ensure cluster stability. Back up cluster state and configuration files before applying the update. Roll out the fix to production clusters during a maintenance window to minimise disruption. Verify that authentication is enforced on administrative interfaces after the update.
What to do and how to stay safe: Dgraph
- Restrict network access to Dgraph Zero port 6080 to trusted management IPs only.
- Monitor Dgraph Zero logs for unusual /removeNode or /moveTablet requests.
- Upgrade to Dgraph Zero 25.4.0 as soon as possible.
- Verify that administrative interfaces require authentication in all environments.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Dgraph Zero are affected by this vulnerability?
All versions of Dgraph Zero prior to 25.4.0 are affected by this unauthenticated admin flaw.
Is there a fix available for CVE-2026-102748?
Yes, the issue is fixed in Dgraph Zero version 25.4.0.
What can an attacker do with this vulnerability?
An attacker can read topology, allocate identifiers, move tablets, or remove nodes, disrupting the control plane.
