CVE-2026-54061 Details
Description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.
A vulnerability exists in Dgraph Alpha versions through 25.3.4, where the RPCs for external snapshot import are exposed on the public gRPC port :9080 without any authentication or authorization. This allows an unauthenticated network client to initiate the 'StreamExtSnapshot' RPC and send Badger stream data to the target group's store. The vulnerability is particularly concerning because the 'Prepare()' method is called before the stream is processed, leading to the deletion of existing database data. This issue has been patched in version 25.3.5.
Users are advised to update to Dgraph version 25.3.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 | [email protected] | Release NotesVendor |
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dgraph | <= 25.3.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |