External risk intelligence

Dgraph Zero Unauthenticated Administrative Access Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-102748

The vulnerable component is an administrative interface for a distributed database management node (Dgraph Zero). While it uses network protocols, such control plane interfaces are typically deployed within isolated internal management networks or behind VPC boundaries and are not intended for direct exposure to the public internet in standard deployments.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Dgraph Zero, an open-source distributed GraphQL database, allows unauthenticated remote attackers to access administrative functions. This could disrupt the database's control plane and destabilize dependent nodes, impacting the availability of the database. The main concern is confirming relevance and exposure given the nature of the affected component.

Unauthenticated database control disruption.
Affects distributed database availability.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a Dgraph Zero instance by sending requests to its administrative HTTP port, even without any authentication. By targeting the /removeNode route, an attacker could remove membership from the database cluster, which could destabilize other nodes and disrupt the entire system.

No authentication required for access.
Triggers vulnerability via administrative route.
Risks disrupting cluster control plane.

Live Threat

Current exploitation, exposure, and threat context

When the administrative interface is enabled, unauthenticated remote attackers who can reach the Dgraph Zero HTTP port could disrupt the control plane by removing membership, which may destabilize dependent Alpha nodes.

Control plane membership.
Membership removal via HTTP.
Service disruption and instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dgraph platform owner or the infrastructure team managing the Dgraph Zero instances are likely responsible for addressing this vulnerability. The first practical step is to identify all Dgraph Zero instances, confirm their network reachability and business criticality, and then engage the accountable owner to plan remediation, which may involve coordinating with the Dgraph vendor.

Identify Dgraph Zero instances and their exposure.
Verify administrative interface reachability and criticality.
Plan Dgraph Zero upgrade or access control.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dgraph and the Zero component?

Dgraph is an open-source distributed graph database that uses GraphQL for queries. The Zero component acts as the control plane for the database cluster. It manages the cluster's metadata, coordinates the distribution of data across different Alpha nodes, and keeps the overall system state consistent. If the Zero component fails or is manipulated, the rest of the database cluster cannot function reliably.

What does this CVE mean in plain English?

This vulnerability involves missing authentication for critical functions (CWE-306) and missing authorization (CWE-862). Essentially, the software creates administrative web pages that anyone can visit without logging in. Because these pages allow sensitive actions—like removing nodes from the cluster—an unauthorized person can effectively sabotage how the database is organized and cause the entire system to stop working properly.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted HTTP requests to the administrative port (6080) of a Dgraph Zero instance. The vulnerability does not occur if the administrative interface is disabled or if the attacker cannot reach port 6080 over the network. Simply having the software installed is not enough; the attacker must be able to communicate directly with this specific management route to perform actions like node removal.

Do I need to worry if my database is internal?

According to Halo Surface Signal, this vulnerability is unlikely to be reachable if your infrastructure follows standard security practices. Dgraph Zero's administrative interface is designed for internal management and should ideally be isolated within a private network or behind a restricted boundary. If your database management ports are exposed to the public internet, your risk is significantly higher than if they are kept within a protected, non-public network.

What is the first step to fix this?

The most effective way to address this is to upgrade your Dgraph software to version 25.4.0 or later, which includes the necessary security fixes. Before updating, identify where your Dgraph Zero instances are running and verify whether their administrative ports are reachable from outside your trusted network. If an immediate upgrade is not possible, ensure that the administrative interface is restricted using firewall rules or network access controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.