fkie_cve-2026-102748

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

GHSA-qj98-gp63-54xj — Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Affected: Go: github.com/dgraph-io/dgraph/v25

### Summary

Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is reachable.

The exposed routes include:

- `/state` - `/assign` - `/removeNode` - `/moveTablet`

An unauthenticated request to `/removeNode?id=1&group=0` on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to `localhost:5080`.

### Details

The issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper.

Relevant code paths:

- `worker/server_state.go:41` - `dgraph/cmd/zero/run.go:295-301` - `dgraph/cmd/zero/http.go:106-129` - `dgraph/cmd/zero/zero.go:475-477`

The relevant behavior is:

- `disable-admin-http=false` by default - `/removeNode` accepts attacker-controlled `id` and `group` - `removeNode` forwards those directly into `Server.RemoveNode` - for `group=0`, `Server.RemoveNode` immediately calls `ProposePeerRemoval`

This means a remote unauthenticated caller can directly trigger destructive membership operations if `6080` is exposed.

### PoC

### Read state without authentication

```bash curl -i http://127.0.0.1:6080/state ```

Observed response included:

- Zero node `id=1` - `groupId=0` - `leader=true` - cluster topology and tablet state

### Write-capable route without authentication…

Most recent entries from all

fkie_cve-2026-102748

GHSA-qj98-gp63-54xj — Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service