Vulnerabilities & Exploits

Dgraph Alpha RPC Lets Outsiders Replace Group Storage

INCIBE-CERT says Dgraph Alpha versions before 25.3.5 expose a critical gRPC snapshot-import RPC, CVE-2026-54061, on public port 9080 without authentication. A remote client that can reach it can make the server erase a chosen group’s storage and load attacker-supplied Badger data instead.

The risky part is not a generic database bug. The StreamExtSnapshot call begins by preparing the target group, which clears existing data before import; in ACL-enabled clusters, replacing group 1 can overwrite internal ACL predicates and shift authorization state.

For operators, the exposure sits where storage maintenance meets trust. If Dgraph Alpha is internet-reachable or otherwise exposed on :9080, a single unauthenticated RPC can become data destruction or privilege escalation, and the fixed boundary is version 25.3.5 or later.

1 source · Aug 21

Timeline

• Aug 21 Reported by INCIBE-CERT

Sources

• Aug 21 INCIBE-CERT

  Falta la autenticación para una función crítica en Dgraph Alpha

  U-ktdi ha reportado una vulnerabilidad crítica en Dgraph Alpha que podría permitir a un atacante no au

  original

Part of the PlainSec briefing for 2026-08-24

Every edition of this story: Dgraph Alpha RPC Lets Outsiders Replace Group Storage

More from today

• Defender flaw now has a PoC and federal clock
• XZ Utils Showed Build Inputs Are Part of the Attack Surface
• GitLab Exploitation Turns Repo History Into a Target