Dgraph Zero: Missing authentication on administrative HTTP routes
Summary
Dgraph Zero, the control-plane component of the Dgraph distributed GraphQL database, registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote attacker who can reach this port can read cluster topology, allocate identifiers, move tablets, or remove cluster members via /removeNode, which disrupts the control plane and can destabilize dependent Alpha nodes. No credentials are required, so exposure of port 6080 is the decisive condition.
Affected
- Dgraph versions before 25.4.0 (the exact earliest affected version is unknown; sources give conflicting ranges)
Fixed in
- Dgraph 25.4.0 (fix commit c32f604)
Workaround
- No vendor workaround beyond upgrading is documented.
- Block access to Zero HTTP port 6080 at the network or host firewall, allowing only trusted administrative hosts.
- Do not expose Zero to the internet.
Exploitation
- Not listed in CISA KEV.
- The vendor reports a lab reproduction of the destructive path.
- No public proof of concept or in-the-wild exploitation has been found; public exploitation is unknown, not confirmed absent.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Check whether any Dgraph Zero instance is reachable on port 6080 from untrusted networks, including test and staging clusters and cloud VMs.
- Restrict port 6080 to trusted hosts immediately.
- Upgrade to Dgraph 25.4.0 or later and plan the upgrade, since the release notes warn of a breaking change in the alpha and zero commands; check Zero startup flags beforehand.
- Configure a --security token or whitelist on Zero after upgrading.
- Monitor Alpha logs for repeated errors that may indicate disruption.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qj98-gp63-54xj github.com
- Fix commit c32f604 github.com
- Dgraph release v25.4.0 github.com
- OSV GHSA-qj98-gp63-54xj osv.dev
- GitLab advisory database advisories.gitlab.com
- Dgraph security overview github.com
- Ratel pull request 432 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:25.
Original description (NVD)
Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.