{"id":"CVE-2026-102748","title":"Dgraph is an open source distributed GraphQL database","summary":"Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts atta…","severity":"critical","cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H","cwe":["CWE-306","CWE-862"],"vendor":"dgraph-io","product":"dgraph","affected":["dgraph < 25.4.0"],"published":"2026-10-14","updated":"2026-10-15","sourceUpdated":"2026-10-15T16:17:32.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102748","references":[{"url":"https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1","label":"security-advisories@github.com"},{"url":"https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0","label":"security-advisories@github.com"},{"url":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102748"},{"url":"https://github.com/advisories/GHSA-qj98-gp63-54xj"},{"url":"https://github.com/dgraph-io/dgraph"}],"tags":["nvd","cve.org","ghsa","go","osv"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-15T14:22:41.542294Z"},"cvssSource":"cna","ingestedAt":"2026-10-14T19:49:57.603Z","aliases":["GHSA-qj98-gp63-54xj"],"ecosystem":"go","patched":["github.com/dgraph-io/dgraph/v25 25.4.0"],"epss":0.00486,"epssPercentile":0.41683,"slug":"CVE-2026-102748","body":"## Overview\n\nDgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-102748)\n\nAffected packages:\n\n- `github.com/dgraph-io/dgraph/v25 <= 25.3.8`\n\nPatched in:\n\n- `github.com/dgraph-io/dgraph/v25 25.4.0`\n\nSource: https://github.com/advisories/GHSA-qj98-gp63-54xj","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":221820,"id":"CVE-2026-102748","ts":1792035836419,"field":"cvss","old":null,"new":"9.2"},{"seq":221819,"id":"CVE-2026-102748","ts":1792035836419,"field":"severity","old":"none","new":"critical"}]}