CVE-2026-102748

CVE-2026-102748 · Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

CVSS 9.2 · Critique · EPSS 0,5%

Publication

2026-10-14T18:34:15.971Z

Mise à jour

2026-10-15T15:06:27.332Z

Vérifiez votre serveur →