CVE-2026-54061 Overview
CVE-2026-54061 is a missing authentication vulnerability [CWE-306] in Dgraph, an open source distributed GraphQL database. Dgraph Alpha exposes the remote procedure calls (RPCs) used for external snapshot import on the public gRPC port :9080 without authentication or authorization. An unauthenticated network attacker can open a StreamExtSnapshot session and send Badger stream data to the target group's store. The receiver calls Prepare() before processing the stream, an operation that deletes and replaces the existing database data. Version 25.3.5 patches the issue.
Critical Impact
Unauthenticated remote attackers can wipe and overwrite Dgraph Alpha database contents by streaming an external snapshot to the exposed gRPC port.
Affected Products
- Dgraph distributed GraphQL database prior to version 25.3.5
- Dgraph Alpha instances exposing gRPC port :9080
- Deployments relying on default Dgraph Alpha network configuration
Discovery Timeline
- 2026-07-08 - CVE-2026-54061 published to the National Vulnerability Database (NVD)
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-54061
Vulnerability Analysis
Dgraph Alpha nodes serve client and cluster traffic over a gRPC endpoint on port :9080. The service registers RPC handlers used for external snapshot import, including StreamExtSnapshot, without enforcing authentication or authorization checks. Any client with network reachability to the port can invoke these RPCs.
The StreamExtSnapshot handler accepts a stream of Badger key-value data intended to restore group state from an external snapshot. Before consuming the stream, the receiver invokes Prepare(), which truncates and replaces the existing store contents on the targeted Raft group.
An attacker who can reach the gRPC port can therefore both destroy existing data and replace it with attacker-controlled content, corrupting cluster state across the group. The integrity and availability impact is severe, though the flaw does not directly expose confidential data through this vector.
Root Cause
The root cause is missing authentication on gRPC RPCs meant for internal or administrative use. Snapshot import handlers were registered on the same public listener that serves client traffic, and no interceptor validated caller identity or authorization before executing destructive operations.
Attack Vector
Exploitation requires only network access to port :9080 on a Dgraph Alpha node. The attacker needs no credentials, no user interaction, and no prior foothold. Using a standard gRPC client compatible with the Dgraph proto definitions, the attacker opens a StreamExtSnapshot call and streams Badger data. The Prepare() call executes on the receiver, dropping existing data before writing the attacker-supplied stream.
See the GitHub Security Advisory GHSA-rrwh-6jrq-wp5v for protocol-level detail.
Detection Methods for CVE-2026-54061
Indicators of Compromise
- Unexpected StreamExtSnapshot gRPC calls to Dgraph Alpha port :9080 from clients outside the cluster's expected peer set.
- Sudden loss of predicates, schema changes, or replacement of stored data across a Raft group without a corresponding administrative action.
- Dgraph Alpha logs showing external snapshot import events or Prepare() invocations without a matching operator-initiated restore.
Detection Strategies
- Inspect network flow logs for inbound TCP connections to port 9080 sourced from non-cluster IP ranges.
- Enable and review Dgraph audit logs for snapshot-related RPCs and correlate against approved change windows.
- Alert on Dgraph process restarts, Raft group state resets, or abrupt drops in stored triple counts.
Monitoring Recommendations
- Baseline expected gRPC clients per Alpha node and alert on new peers initiating snapshot RPCs.
- Monitor database size and schema version metrics for unexplained resets.
- Forward Dgraph logs and network telemetry to a centralized analytics platform for correlation across cluster members.
How to Mitigate CVE-2026-54061
Immediate Actions Required
- Upgrade all Dgraph Alpha nodes to version 25.3.5 or later, which patches the missing authentication check.
- Restrict inbound access to port :9080 at the network layer to trusted application clients and cluster peers only.
- Audit recent snapshot import activity and validate database integrity across all Raft groups.
Patch Information
Dgraph version 25.3.5 addresses CVE-2026-54061 by adding authentication and authorization enforcement on the external snapshot import RPCs. Download the fixed release from the GitHub Release v25.3.5 page and review the GitHub Security Advisory GHSA-rrwh-6jrq-wp5v for upgrade guidance.
Workarounds
- Place Dgraph Alpha behind a firewall, security group, or service mesh that restricts port 9080 to authorized client CIDR ranges.
- Terminate client traffic through an authenticating gRPC proxy that filters snapshot-related RPC methods.
- Isolate Dgraph clusters on a private network segment with no direct exposure to untrusted networks.
# Example: restrict Dgraph Alpha gRPC port to a trusted client subnet using iptables
iptables -A INPUT -p tcp --dport 9080 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
