GHSA-qj98-gp63-54xj: Go/github.com/dgraph-io/dgraph/v25 vulnerability

Q: Which deployments are exposed to remote exploitation?

Dgraph v25.3.8 deployments are exposed when the Zero HTTP port, 6080, is reachable by an attacker. The administrative HTTP interface is enabled by default because disable-admin-http defaults to false.

Q: Does exploitation require credentials or prior access to Dgraph?

No. The Zero administrative routes are registered without authentication or an IP-whitelist wrapper, so an unauthenticated caller that can reach port 6080 can invoke them.

Q: What can an attacker do through the exposed interface?

The exposed routes include /state, /assign, /removeNode, and /moveTablet. In particular, an attacker can supply id and group parameters to /removeNode; when group=0, the request immediately triggers ProposePeerRemoval.

Q: How can I check whether the administrative interface is exposed?

Requesting http://<zero-host>:6080/state without authentication can be used to test whether the interface is reachable and serving the unauthenticated state endpoint. A successful unauthenticated response indicates that this administrative surface is exposed.

Published Oct 15, 2026

Updated

Summary

Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable.

The exposed routes include:

- /state - /assign - /removeNode - /moveTablet

An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to localhost:5080.

Details

The issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper.

Relevant code paths:

- worker/serverstate.go:41 - dgraph/cmd/zero/run.go:295-301 - dgraph/cmd/zero/http.go:106-129 - dgraph/cmd/zero/zero.go:475-477

The relevant behavior is:

- disable-admin-http=false by default - /removeNode accepts attacker-controlled id and group - removeNode forwards those directly into Server.RemoveNode - for group=0, Server.RemoveNode immediately calls ProposePeerRemoval

This means a remote unauthenticated caller can directly trigger destructive membership operations if 6080 is exposed.

PoC

Read state without authentication

bash curl -i http://127.0.0.1:6080/state

Observed response included:

- Zero node id=1 - groupId=0 - leader=true - cluster topology and tablet state

Write-capable route without authentication

bash curl -i 'http://127.0.0.1:6080/assign?what=nsids&num=1'

Observed response:

text HTTP/1.1 200 OK ... {"startId":"1", "endId":"1", "readOnly":"0"}

This confirms the admin plane is not merely informational.

Destructive unauthenticated removeNode

bash curl -i 'http://127.0.0.1:6080/removeNode?id=1&group=0'

Observed result:

text curl: (52) Empty reply from server

Immediately afterward:

bash curl -i http://127.0.0.1:6080/health

Observed result:

text curl: (56) Recv failure: Connection reset by peer

Alpha health was still locally reachable, but Alpha logs began repeatedly reporting:

text dial tcp [::1]:5080: connect: connection refused

This confirms the request reached the destructive path and disrupted the Zero control plane.

Impact

Any deployment that exposes Zero HTTP on 6080 exposes destructive unauthenticated administrative capabilities.

An attacker can:

- read cluster topology and control-plane metadata - allocate IDs and timestamps - invoke destructive membership actions - disrupt the Zero control plane - indirectly destabilize Alpha nodes that depend on Zero connectivity

This is a high-value unauthenticated administrative exposure and, in the reproduced case, a practical denial of service against the control plane.

Affected Software

1 affected componentFixes available

go/github.com/dgraph-io/dgraph/v25<=25.3.8

25.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/dgraph-io/dgraph/v25 to a version that resolves this vulnerability.
Fixed in 25.4.0

Event History

Oct 15, 2026

Advisory Published

via GitHub·08:17 PM

Data Sourced

via GitHub·08:17 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Dgraph v25.3.8 deployments are exposed when the Zero HTTP port, 6080, is reachable by an attacker. The administrative HTTP interface is enabled by default because disable-admin-http defaults to false.

Does exploitation require credentials or prior access to Dgraph?

No. The Zero administrative routes are registered without authentication or an IP-whitelist wrapper, so an unauthenticated caller that can reach port 6080 can invoke them.

What can an attacker do through the exposed interface?

The exposed routes include /state, /assign, /removeNode, and /moveTablet. In particular, an attacker can supply id and group parameters to /removeNode; when group=0, the request immediately triggers ProposePeerRemoval.

How can I check whether the administrative interface is exposed?

Requesting http://<zero-host>:6080/state without authentication can be used to test whether the interface is reachable and serving the unauthenticated state endpoint. A successful unauthenticated response indicates that this administrative surface is exposed.

What is the known impact on a standalone deployment?

On a single-node standalone deployment, an unauthenticated request to /removeNode?id=1&group=0 breaks the Zero control plane. Alpha then repeatedly fails to reconnect to localhost:5080.