{"id":"EUVD-2026-101603","enisaUuid":"fabb9224-4509-32db-9921-5b473a782ee7","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.","datePublished":"Oct 14, 2026, 6:34:15 PM","dateUpdated":"Oct 15, 2026, 3:06:27 PM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj\nhttps://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.4.0\n","aliases":"CVE-2026-102748\nGHSA-qj98-gp63-54xj\n","assigner":"GitHub_M","epss":0.62,"enisaIdProduct":[{"id":"43a27153-628a-31b7-b17f-25d8ce269b96","product":{"name":"dgraph","vendor":{"name":"dgraph-io"}},"product_version":"\u003c 25.4.0"}],"enisaIdVendor":[{"id":"db3c5c42-5260-3c63-8238-92d8df09d2d0","vendor":{"name":"dgraph-io"}}],"enisaIdVulnerability":[{"id":"298c2f53-9300-3055-9bd2-ed3108ce7e64","vulnerability":{"id":"GHSA-qj98-gp63-54xj","description":"Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service","datePublished":"Oct 15, 2026, 8:17:22 PM","dateUpdated":"Oct 15, 2026, 8:17:22 PM","baseScore":0.0,"references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102748\nhttps://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1\nhttps://github.com/dgraph-io/dgraph\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.4.0\n","enisa_id":"EUVD-2026-101603\n","aliases":"CVE-2026-102748\nGHSA-qj98-gp63-54xj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d1f2b4c7-4d84-35dc-8559-ffcb8ef0d9be","vulnerability":{"id":"CVE-2026-102748","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.","datePublished":"Oct 14, 2026, 6:34:15 PM","dateUpdated":"Oct 15, 2026, 3:06:27 PM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H","references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj\nhttps://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.4.0\n","enisa_id":"EUVD-2026-101603\n","assigner":"GitHub_M","epss":0.62,"dataProcessed":"Nov 4, 2026, 7:14:56 AM","vulnerabilityProduct":[{"id":"7153243c-7930-304b-b768-20bf78ec04de","product":{"name":"dgraph","vendor":{"name":"dgraph-io"}},"product_version":"\u003c 25.4.0"}],"vulnerabilityVendor":[{"id":"e697763e-8dce-3c1b-aff4-a03fae1a5c36","vendor":{"name":"dgraph-io"}}]}}],"enisaIdAdvisory":[]}