CVE-2026-54061 | Dgraph is an open source distributed GraphQL database. Prior… | CVSS 9.1 CRITICAL

Description

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Metadata

CVE ID: CVE-2026-54061
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-11 18:24 UTC
Published: 2026-07-08 13:23 UTC
Last updated: 2026-07-08 14:26 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: dgraph-io / dgraph
Sources: cve.org · NVD

Severity & Metrics

9.1 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
dgraph-io	dgraph	—	< 25.3.5

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306: Missing Authentication for Critical Function

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.1	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References (2)

https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v
https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5