Unauthenticated Administrative API Exposure in Dgraph Zero

Dgraph versions up to and including 25.3.8 contain a critical vulnerability in the Zero control plane component. The service registers administrative HTTP endpoints - such as /state, /assign, and /removeNode - directly on port 6080 without implementing any authentication or IP-based access control. By default, the disable-admin-http configuration flag is set to false, making these endpoints accessible to any entity with network reachability to the port.

This vulnerability allows unauthenticated remote actors to query cluster metadata and topology information. Furthermore, attackers can invoke state-changing administrative operations, specifically the /removeNode endpoint. Successful exploitation of this endpoint triggers destructive cluster membership changes, leading to a permanent denial of service for the Zero control plane and causing connected Alpha nodes to fail due to lost connectivity to the control plane. Organizations using Dgraph should prioritize restricting access to port 6080 to trusted internal management networks only.

Attack Chain

1. Attacker performs network discovery to identify accessible services on port 6080.
2. Attacker sends an unauthenticated HTTP GET request to /state to enumerate cluster topology, node IDs, and leader status.
3. Attacker sends an unauthenticated HTTP GET request to /assign to interact with node allocation and control plane functionality.
4. Attacker identifies a target node ID and group ID via the information gathered in step 2.
5. Attacker sends a malicious HTTP GET request to /removeNode?id=[ID]&group=[GROUP] to initiate the peer removal process.
6. Zero control plane processes the request, invoking Server.RemoveNode and ProposePeerRemoval without authorization validation.
7. The target node is removed from the cluster topology, causing the Zero control plane to crash or enter an unstable state.
8. Dependent Alpha nodes fail to reconnect to the Zero control plane, resulting in a persistent denial of service.

Impact

The vulnerability allows unauthenticated remote attackers to perform unauthorized administrative actions against the Dgraph Zero control plane. This leads to information disclosure regarding cluster topology and facilitates a persistent denial of service (DoS) by destabilizing cluster membership. The impact is significant for production environments, as it renders the Dgraph deployment unusable until manual intervention and control plane recovery are performed.

Recommendation

• Immediately restrict network access to port 6080, ensuring it is not exposed to the public internet or untrusted network segments.
• Update Dgraph installations to a patched version beyond 25.3.8 once available from the vendor.
• Monitor webserver logs for unauthorized HTTP GET requests directed at sensitive endpoints: /state, /assign, /removeNode, and /moveTablet.
• Configure disable-admin-http=true in the Dgraph Zero configuration if administrative HTTP capabilities are not strictly required for current operations.