PkgSeer

Vulnerability GO-2026-6261

Unknown

1 month ago

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8

Summary

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

Details

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

v25.0.0-custom-qt-improv-1 - v25.4.0-preview1 GHSA-qj98-gp63-54xj

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

v25.0.0-custom-qt-improv-1 - v25.3.4 GHSA-rrwh-6jrq-wp5v

Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.1 GO-2026-5274

Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

v25.0.0-custom-qt-improv-1 - v25.3.1 GO-2026-5274

Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph

v0.4.0 - v1.2.8 GO-2026-5516

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

1 month ago

Fixed (v25.3.5)

4 months ago

Last Modified

1 month ago