Dgraph Alpha RPC Lets Outsiders Replace Group Storage
INCIBE-CERT says Dgraph Alpha versions before 25.3.5 expose a critical gRPC snapshot-import RPC, CVE-2026-54061, on public port 9080 without authentication. A remote client that can reach it can make the server erase a chosen group’s storage and load attacker-supplied Badger data instead.
The risky part is not a generic database bug. The StreamExtSnapshot call begins by preparing the target group, which clears existing data before import; in ACL-enabled clusters, replacing group 1 can overwrite internal ACL predicates and shift authorization state.
For operators, the exposure sits where storage maintenance meets trust. If Dgraph Alpha is internet-reachable or otherwise exposed on :9080, a single unauthenticated RPC can become data destruction or privilege escalation, and the fixed boundary is version 25.3.5 or later.