https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T16:48:34.660326+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-102748 fkie_cve-2026-102748 2026-10-20T16:48:34.686557+00:00

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

 https://db.gcve.eu/vuln/ghsa-qj98-gp63-54xj GHSA-qj98-gp63-54xj — Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service 2026-10-20T16:48:34.686680+00:00

Affected: Go: github.com/dgraph-io/dgraph/v25

### Summary

Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is reachable.

The exposed routes include:

- `/state` - `/assign` - `/removeNode` - `/moveTablet`

An unauthenticated request to `/removeNode?id=1&group=0` on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to `localhost:5080`.

### Details

The issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper.

Relevant code paths:

- `worker/server_state.go:41` - `dgraph/cmd/zero/run.go:295-301` - `dgraph/cmd/zero/http.go:106-129` - `dgraph/cmd/zero/zero.go:475-477`

The relevant behavior is:

- `disable-admin-http=false` by default - `/removeNode` accepts attacker-controlled `id` and `group` - `removeNode` forwards those directly into `Server.RemoveNode` - for `group=0`, `Server.RemoveNode` immediately calls `ProposePeerRemoval`

This means a remote unauthenticated caller can directly trigger destructive membership operations if `6080` is exposed.

### PoC

### Read state without authentication

```bash curl -i http://127.0.0.1:6080/state ```

Observed response included:

- Zero node `id=1` - `groupId=0` - `leader=true` - cluster topology and tablet state

<img width="1878" height="810" alt="图片" src="https://github.com/user-attachments/assets/c6a0001c-bcf7-45b6-a301-481f918be98a" />

### Write-capable route without authentication…