CVE-2026-54061CWE-306

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Critical · published July 8, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00582 · 47.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-08T13:23Z
EPSS history
Timeline
  • 08 JUL 13:23Z
    Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
    cvelistv5