{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adgraphdgraph/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102748"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dgraph (\u003c= 25.3.8)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","denial-of-service","dgraph"],"_cs_type":"advisory","_cs_vendors":["Dgraph"],"content_html":"\u003cp\u003eDgraph versions up to and including 25.3.8 contain a critical vulnerability in the Zero control plane component. The service registers administrative HTTP endpoints - such as \u003ccode\u003e/state\u003c/code\u003e, \u003ccode\u003e/assign\u003c/code\u003e, and \u003ccode\u003e/removeNode\u003c/code\u003e - directly on port 6080 without implementing any authentication or IP-based access control. By default, the \u003ccode\u003edisable-admin-http\u003c/code\u003e configuration flag is set to \u003ccode\u003efalse\u003c/code\u003e, making these endpoints accessible to any entity with network reachability to the port.\u003c/p\u003e\n\u003cp\u003eThis vulnerability allows unauthenticated remote actors to query cluster metadata and topology information. Furthermore, attackers can invoke state-changing administrative operations, specifically the \u003ccode\u003e/removeNode\u003c/code\u003e endpoint. Successful exploitation of this endpoint triggers destructive cluster membership changes, leading to a permanent denial of service for the Zero control plane and causing connected Alpha nodes to fail due to lost connectivity to the control plane. Organizations using Dgraph should prioritize restricting access to port 6080 to trusted internal management networks only.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network discovery to identify accessible services on port 6080.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP GET request to \u003ccode\u003e/state\u003c/code\u003e to enumerate cluster topology, node IDs, and leader status.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP GET request to \u003ccode\u003e/assign\u003c/code\u003e to interact with node allocation and control plane functionality.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target node ID and group ID via the information gathered in step 2.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malicious HTTP GET request to \u003ccode\u003e/removeNode?id=[ID]\u0026amp;group=[GROUP]\u003c/code\u003e to initiate the peer removal process.\u003c/li\u003e\n\u003cli\u003eZero control plane processes the request, invoking \u003ccode\u003eServer.RemoveNode\u003c/code\u003e and \u003ccode\u003eProposePeerRemoval\u003c/code\u003e without authorization validation.\u003c/li\u003e\n\u003cli\u003eThe target node is removed from the cluster topology, causing the Zero control plane to crash or enter an unstable state.\u003c/li\u003e\n\u003cli\u003eDependent Alpha nodes fail to reconnect to the Zero control plane, resulting in a persistent denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated remote attackers to perform unauthorized administrative actions against the Dgraph Zero control plane. This leads to information disclosure regarding cluster topology and facilitates a persistent denial of service (DoS) by destabilizing cluster membership. The impact is significant for production environments, as it renders the Dgraph deployment unusable until manual intervention and control plane recovery are performed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict network access to port 6080, ensuring it is not exposed to the public internet or untrusted network segments.\u003c/li\u003e\n\u003cli\u003eUpdate Dgraph installations to a patched version beyond 25.3.8 once available from the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unauthorized HTTP GET requests directed at sensitive endpoints: \u003ccode\u003e/state\u003c/code\u003e, \u003ccode\u003e/assign\u003c/code\u003e, \u003ccode\u003e/removeNode\u003c/code\u003e, and \u003ccode\u003e/moveTablet\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eConfigure \u003ccode\u003edisable-admin-http=true\u003c/code\u003e in the Dgraph Zero configuration if administrative HTTP capabilities are not strictly required for current operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:23:08Z","date_published":"2026-10-15T22:23:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dgraph-zero-unauth-admin/","summary":"Dgraph versions up to 25.3.8 expose an unauthenticated HTTP administrative API on port 6080, allowing remote attackers to perform unauthorized cluster membership operations and cause denial of service.","title":"Unauthenticated Administrative API Exposure in Dgraph Zero","url":"https://feed.craftedsignal.io/briefs/2026-10-dgraph-zero-unauth-admin/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}