Authentication Bypass in Dgraph Zero Administrative Interface

CVE-2026-102748

What is CVE-2026-102748?

An authentication bypass vulnerability exists in Dgraph Zero, an open-source distributed GraphQL database. Before version 25.4.0, the administrative HTTP routes were registered on port 6080 without adequate authentication measures. This exposure allows unauthenticated remote attackers to exploit various administrative functionalities, such as reading topology through the /state endpoint, allocating identifiers via the /assign route, accessing the /moveTablet administrative route, and removing nodes using /removeNode, which can disrupt the management of the Zero control plane and destabilize connected Alpha nodes. This critical issue highlights the need for timely updates and patches to ensure the security of Dgraph installations.

References