CVE-2026-54061: Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port :9080 without authentication or authorization. As a result, an unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target group’s store. In addition, the receiver calls Prepare() before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dgraph Alphato a version that resolves this vulnerability.Fixed in 25.3.5 - Compensating control
Restrict the public gRPC port :9080 for Dgraph Alpha so that external snapshot import RPCs are not reachable by unauthenticated network clients (e.g., limit access to trusted IPs / networks via firewall or network ACL) for deployments prior to version 25.3.5.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54061?
The severity of CVE-2026-54061 is rated as critical with a score of 9.1.
How do I fix CVE-2026-54061?
To fix CVE-2026-54061, upgrade Dgraph Alpha to version 25.3.5 or later.
What impact does CVE-2026-54061 have on Dgraph?
CVE-2026-54061 allows unauthenticated network clients to potentially replace Dgraph Alpha group stores via external snapshot import.
Which versions of Dgraph are affected by CVE-2026-54061?
Dgraph versions prior to 25.3.5 are affected by CVE-2026-54061.
Is authentication required to exploit CVE-2026-54061?
No, CVE-2026-54061 can be exploited without any authentication or authorization.