{"id":"EUVD-2026-42235","enisaUuid":"6402ebe8-a95e-3726-abc8-f9988e126d4b","description":"Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.","datePublished":"Jul 8, 2026, 1:23:56 PM","dateUpdated":"Jul 8, 2026, 2:26:13 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.3.5\n","aliases":"CVE-2026-54061\nGHSA-rrwh-6jrq-wp5v\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"54ae6cb1-91a2-30f8-936f-f42844427434","product":{"name":"dgraph","vendor":{"name":"dgraph-io"}},"product_version":"\u003c 25.3.5"}],"enisaIdVendor":[{"id":"e3f288f1-56b8-3093-9bf4-f9d40f71d51f","vendor":{"name":"dgraph-io"}}],"enisaIdVulnerability":[{"id":"4af20918-3365-31e5-b191-a7fa4b856e3c","vulnerability":{"id":"GHSA-rrwh-6jrq-wp5v","description":"Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import","datePublished":"Aug 20, 2026, 5:29:00 PM","dateUpdated":"Aug 20, 2026, 5:29:00 PM","baseScore":0.0,"references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54061\nhttps://github.com/dgraph-io/dgraph\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.3.5\n","enisa_id":"EUVD-2026-42235\n","aliases":"CVE-2026-54061\nGHSA-rrwh-6jrq-wp5v\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cb65b154-9861-382c-8b1b-6195c9b6c45d","vulnerability":{"id":"CVE-2026-54061","description":"Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.","datePublished":"Jul 8, 2026, 1:23:56 PM","dateUpdated":"Jul 8, 2026, 2:26:13 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v\nhttps://github.com/dgraph-io/dgraph/releases/tag/v25.3.5\n","enisa_id":"EUVD-2026-42235\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 7, 2026, 7:20:27 AM","vulnerabilityProduct":[{"id":"3ee4430c-833c-35a9-a17e-a4ec44111dda","product":{"name":"dgraph","vendor":{"name":"dgraph-io"}},"product_version":"\u003c 25.3.5"}],"vulnerabilityVendor":[{"id":"9138fb7b-41ea-3409-9253-28b6f9a8df3e","vendor":{"name":"dgraph-io"}}]}}],"enisaIdAdvisory":[]}