DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54061: CVE-2026-54061: Unauthenticated Database Wipe and Replacement in Dgraph Alpha

#security #cve #cybersecurity

CVE-2026-54061: Unauthenticated Database Wipe and Replacement in Dgraph Alpha

Vulnerability ID: CVE-2026-54061
CVSS Score: 9.1
Published: 2026-08-20

A critical vulnerability in Dgraph Alpha allows unauthenticated network clients to delete and replace database stores. The public gRPC interface on port 9080 processes external snapshot streams without enforcing authentication or authorization, triggering immediate database destruction via the storage engine's initialization process.

TL;DR

Unauthenticated remote attackers can connect to Dgraph's public gRPC port and trigger an external snapshot stream, causing the underlying storage engine to immediately wipe and replace all database records without validation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-306
  • Attack Vector: Network
  • CVSS v3.1: 9.1 (Critical)
  • Impact: Integrity & Availability (Data Loss)
  • Exploit Status: PoC Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Dgraph Alpha
  • Dgraph: < 25.3.5 (Fixed in: v25.3.5)

Code Analysis

Commit: aba579a

Fix unauthenticated external snapshot stream vulnerability

Exploit Details

  • GitHub: Integration verification test included in the official fix commit reproduces the complete wipe sequence.

Mitigation Strategies

  • Restrict ingress traffic to the gRPC port (9080) using firewalls or security groups.
  • Enable Access Control Lists (ACL) and ensure security auth tokens are active.
  • Upgrade all running instances to v25.3.5 or later.

Remediation Steps:

  1. Identify all deployed Dgraph Alpha instances and verify their current version.
  2. Update the container images or binaries of Dgraph Alpha to version v25.3.5.
  3. Verify that client applications can connect securely and test connection logs for unauthorized access blocks.
  4. Isolate internal gRPC traffic to the private network cluster to block public scanning.

References

Read the full report for CVE-2026-54061 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)