PT-2026-56423 · Dgraph · Dgraph

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-54061

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.5

Description Dgraph Alpha exposes privileged RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. An unauthenticated network client can access the StreamExtSnapshot endpoint to send Badger stream data to the target group store. Because the receiver executes the Prepare() function before processing the stream, this operation deletes and replaces the existing database data, leading to full database destruction, service outages, and data loss.

Recommendations Update to version 25.3.5.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-54061

GHSA-RRWH-6JRQ-WP5V

Affected Products

Dgraph

References · 6

• 🔥 https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54061.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-54061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54061 · Security Note
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5 · Note
• https://twitter.com/UpwindMDR/status/2074903228244722159 · Twitter Post