Unauthenticated Remote Data Replacement in Dgraph Alpha

Dgraph Alpha versions 25.3.4 and earlier are vulnerable to an unauthenticated remote code execution and data manipulation flaw due to improper access control in its public gRPC interface (port :9080). The service exposes the StreamExtSnapshot method without requiring authentication, authorization, or mTLS. Because the server-side implementation calls StreamWriter.Prepare() before processing incoming data streams, an unauthenticated client can trigger the immediate deletion of an existing database group store. Attackers can leverage this to clear production data or replace the group store with arbitrary Badger stream data. This vulnerability is particularly dangerous when targeting Group 1, which houses internal ACL and predicate information, as the ability to inject custom data here facilitates unauthorized privilege escalation within the Dgraph cluster.

Attack Chain

1. Attacker identifies a Dgraph Alpha instance reachable over the network on port :9080.
2. Attacker establishes a standard gRPC connection to the target without providing a JWT, ACL token, or auth-token metadata.
3. Attacker invokes the Dgraph.StreamExtSnapshot RPC method against a specific group ID (e.g., Group 1).
4. The Dgraph server fails to validate the requester's authorization context, accepting the stream request.
5. The server-side logic triggers worker.runLocalSubscriber and subsequently calls pstore.NewStreamWriter().Prepare().
6. The target group's database is purged by the Dgraph engine as part of the Prepare() operation.
7. Attacker sends a stream packet with a Done flag, or alternatively, streams valid Badger data chunks to overwrite the store.
8. Final objective achieved: targeted database contents are replaced with attacker-controlled data, causing potential privilege escalation or service disruption.

Impact

Successful exploitation allows for the complete removal of existing data or the substitution of database contents with malicious payloads. By overwriting the database group responsible for access control (Group 1), an attacker can inject rogue administrative accounts or modify ACL settings to grant themselves elevated privileges, compromising the integrity and security of the entire Dgraph cluster.

Recommendation

1. Immediately restrict network access to Dgraph gRPC port :9080, ensuring it is not exposed to the public internet or untrusted networks.
2. Upgrade all Dgraph Alpha instances to a patched version beyond 25.3.4 once available from the vendor.
3. Enforce mTLS for all gRPC communications to ensure only authorized clients can interact with the Alpha service.
4. Review database group 1 for unauthorized changes or unexpected ACL modifications that may indicate exploitation of this vulnerability.