{"id":"CVE-2026-102748","revision":"a341015030a6494280253ad9ff1c14bb","records":[{"revision":"a341015030a6494280253ad9ff1c14bb","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102748","aliases":[],"title":"Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.","state":0,"publishedAt":"2026-10-14T18:34:15.971+00:00","modifiedAt":"2026-10-15T15:06:27.332+00:00","affected":[{"ecosystem":"Vendor product","name":"dgraph","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dgraph-io\",\n                    \"product\": \"dgraph\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 25.4.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H","score":9.2,"severity":"CRITICAL"}],"references":["https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj","https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1","https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102748","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102748","identifiers":["CVE-2026-102748"]},"retained":false,"historicalAffected":[]}],"coverage":[]}