Dgraph Zero CVE-2026-102748

Requires (1) the Zero administrative interface to be enabled and (2) network reachability to Zero's admin HTTP port (default 6080) from the attacker. No authentication is required (PR:N confirmed) and no user interaction is needed; the affected routes (/state, /assign, /moveTablet, /removeNode) are served without any token or IP check in versions prior to 25.4.0. The /removeNode destructive path specifically operates on attacker-controlled id and group values, with group 0 triggering ProposePeerRemoval. The primary LIMITING factor is network exposure: Zero's HTTP/gRPC surface is designed to sit on a trusted network, so exploitation is realistic only where port 6080 is exposed to untrusted networks; after the fix, destructive endpoints are loopback-only unless a --security token or whitelist is configured.

The vendor CVSS 4.0 base score of 9.2 is driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high integrity and availability impact on the vulnerable system and high availability impact on subsequent systems (VI:H/VA:H/SA:H) - the SA:H correctly captures that compromising Zero cascades to destabilize dependent Alpha nodes. CWE-306 (Missing Authentication for a Critical Function) is confirmed by both the description and the fix commit, which adds a token/IP-whitelist guard. However, several real-world-risk signals are MISSING from the input: there is no EPSS score, no CISA KEV entry, and no flagged public exploit, so exploitation probability cannot be quantified from the data provided - classify as no public exploit identified at time of analysis. The single most important mitigating factor, explicit in the fix's own comments, is that port 6080 was never intended to be internet-exposed and network isolation is the primary control for Zero's admin/gRPC surface; the fix even keeps /state and /assign open by default and only hard-guards the destructive /removeNode and /moveTablet routes (loopback-only unless a token/whitelist is set). Net: this is a genuine high-severity flaw for any deployment that exposes the Zero HTTP port beyond a trusted network, but real-world risk is sharply gated by whether port 6080 is reachable by the attacker - a property not knowable from the CVE data alone. Note one nuance: the description says /state can read cluster topology, a confidentiality effect the vendor vector scores as VC:N; this analysis treats it as a low confidentiality impact.

An attacker who can reach Dgraph Zero's administrative HTTP port (default 6080) - e.g. a Zero instance inadvertently exposed to the internet or reachable from a compromised internal host - sends an unauthenticated request to /removeNode with chosen id and group values. With group 0, this reaches Server.RemoveNode and ProposePeerRemoval, evicting cluster members and disrupting the Zero control plane so that dependent Alpha nodes become unstable. The advisory demonstrates the membership-removal path, but no public weaponized exploit code is indicated in the provided data.