GO-2026-6261
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph
At a glance
- Published
- Updated
- CVE
- CVE-2026-54061
- Aliases
- GHSA-rrwh-6jrq-wp5v
Description
Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.5 |
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v ADVISORY
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |