Advisoriesby IbisDgraphGO-2026-6261
Dgraph Alpha exposes the RPCs used for external snapshot import on the public...
No fix yet
Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/dgraph-io/dgraph Go | all versions | No fix yet |
Changes since it was listed
Severity: Unrated to Critical
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Severity from
- NVD
- Also known as
- CVE-2026-54061, GHSA-rrwh-6jrq-wp5v
More Dgraph advisories
All Dgraph
DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraphCVE-2026-44840no fix yetDgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/varsCVE-2026-41492no fix yetDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang FieldCVE-2026-41328no fix yetDgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition FieldCVE-2026-41327no fix yetDgraph: information disclosureCVE-2026-40173no fix yetDgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing AuthorizationCVE-2026-34976no fix yet