What is the CVSS score of CVE-2026-54061?

CVE-2026-54061 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dgraph are affected by CVE-2026-54061?

Dgraph Alpha versions prior to 25.3.5 contain a critical authentication bypass allowing unauthenticated attackers to completely destroy and overwrite entire databases via exposed port 9080.. A patch is available.

Is there a public PoC exploit available for CVE-2026-54061?

Yes, a public proof-of-concept exploit is available for CVE-2026-54061. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-54061?

Within 24 hours: Audit all Dgraph Alpha deployments and immediately restrict untrusted network access to port 9080 using firewall rules; segment Dgraph from external networks. Within 7 days: Disable the external snapshot import RPC unless operationally required; deploy monitoring for suspicious port 9080 activity. Within 30 days: Upgrade all Dgraph Alpha instances to version 25.3.5 or later.

Dgraph CVE-2026-54061

EUVD-2026-42235 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-08 security-advisories@github.com

GHSA-rrwh-6jrq-wp5v

Authentication Bypass Suse

9.1

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated, low-complexity network RPC on :9080 (AV:N/AC:L/PR:N/UI:N); Prepare() destroys and replaces data giving I:H/A:H, while no data is read so C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 15:01 EUVD

Analysis Generated

Jul 08, 2026 - 14:37 vuln.today

DescriptionCVE.org

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiver calls Prepare() before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

AnalysisAI

Missing authentication in Dgraph Alpha lets an unauthenticated network client destroy and overwrite an entire database group's data via the external-snapshot import RPCs exposed on the public gRPC port :9080. Any attacker able to reach port 9080 can open a StreamExtSnapshot session; because the receiver calls Prepare() before ingesting the stream, the existing store is deleted and replaced with attacker-supplied Badger data. Fixed in version 25.3.5; no public exploit identified at time of analysis.

Technical ContextAI

Dgraph is an open-source distributed GraphQL/graph database in which 'Alpha' nodes hold and serve the sharded data. Nodes normally use gRPC on port :9080 both for client queries and for internal streaming operations, including external snapshot import which uses Badger (Dgraph's embedded LSM key-value store) stream data. The flaw is CWE-306 (Missing Authentication for a Critical Function): the StreamExtSnapshot RPC and the associated snapshot-import path are reachable on the public :9080 port with no authentication or authorization gate. Compounding the exposure, the receive path invokes Prepare() before processing the incoming stream, and Prepare() clears and replaces the existing on-disk store, converting an unauthenticated RPC into a full data-destruction primitive.

RemediationAI

Vendor-released patch: upgrade Dgraph to version 25.3.5 or later, which adds the missing authentication/authorization on the snapshot-import RPCs (release https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5, advisory https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v). Until patching is possible, restrict network reachability of the Alpha gRPC port :9080 so it is accessible only to trusted application clients and cluster peers - bind it to internal interfaces, place it behind a firewall/security group, or use network policies in Kubernetes - accepting that overly aggressive filtering can break legitimate client connectivity and inter-node streaming if the same port is shared. Where supported, enable Dgraph's ACL/mTLS transport security on :9080 to authenticate clients; note this adds certificate/credential management overhead and must be rolled out to all legitimate clients to avoid outages. Ensure database backups are current and offline so that a destructive Prepare()/overwrite can be recovered.