CVE-2026-102748: 
Wolfi vulnerability analysis and mitigation

CVE-2026-102748 is a missing authentication vulnerability in Dgraph Zero's administrative HTTP interface that allows remote unauthenticated attackers to disrupt the Zero control plane and destabilize dependent Alpha nodes. Affecting all versions of Dgraph prior to 25.4.0, the flaw was disclosed on October 14, 2026, with the fix released in v25.4.0. The vulnerability carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). Dgraph Zero registers administrative HTTP routes on port 6080 — specifically /state, /assign, /removeNode, and /moveTablet — without any authentication or IP-whitelist enforcement, as implemented in dgraph/cmd/zero/run.go (lines 295–301), dgraph/cmd/zero/http.go (lines 106–129), and dgraph/cmd/zero/zero.go (lines 475–477). The /removeNode route accepts attacker-controlled id and group query parameters and passes them directly to Server.RemoveNode; when group=0 is supplied, it immediately triggers ProposePeerRemoval, a destructive Raft membership operation. No preconditions beyond network reachability of port 6080 are required — no credentials, no prior access, and no user interaction (GitHub Advisory, Patch Commit).

A remote unauthenticated attacker who can reach port 6080 can read full cluster topology and control-plane metadata via /state, allocate identifiers and timestamps via /assign, move tablet assignments via /moveTablet, and remove cluster membership via /removeNode. Triggering /removeNode?id=1&group=0 on a standalone deployment immediately crashes the Zero process, causing Alpha nodes to repeatedly fail reconnection to the Zero gRPC port (default 5080), resulting in a practical denial of service against the entire Dgraph control plane. While direct data exfiltration from the graph database is not the primary impact, exposure of cluster topology metadata and the ability to disrupt database availability represent significant integrity and availability risks (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time. However, the vulnerability is trivially exploitable using standard HTTP tools such as curl with no special knowledge or tooling required, as demonstrated in the security advisory's PoC section. The EPSS score is 0.0, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Dgraph Zero instances by scanning for open TCP port 6080 using tools like Shodan, Censys, or nmap. Confirm the target is running Dgraph Zero prior to version 25.4.0.
2. Verify unauthenticated access: Probe the /health endpoint to confirm the service is running, then query /state to read cluster topology without credentials: curl -i http://<target>:6080/state. A successful response reveals Zero node IDs, group IDs, leader status, and tablet state.
3. Confirm write access: Verify that allocation endpoints are also unauthenticated: curl -i 'http://<target>:6080/assign?what=nsids&num=1'. A 200 OK response with startId/endId confirms the admin plane is writable.
4. Execute destructive membership removal: Send a crafted request to /removeNode with id=1 and group=0 to trigger ProposePeerRemoval and crash the Zero control plane: curl -i 'http://<target>:6080/removeNode?id=1&group=0'.
5. Observe impact: The Zero process terminates (connection reset or empty reply). Alpha nodes begin logging repeated connection failures to the Zero gRPC port (dial tcp [::1]:5080: connect: connection refused), rendering the Dgraph cluster unavailable (GitHub Advisory).

• Network: Unexpected HTTP GET/POST requests to port 6080 from external or non-administrative IP addresses targeting /removeNode, /moveTablet, /assign, or /state endpoints; sudden loss of connectivity to the Zero gRPC port (default 5080) from Alpha nodes.
• Logs: Dgraph Alpha logs showing repeated dial tcp [::1]:5080: connect: connection refused errors following an external request to Zero's HTTP port; Zero HTTP access logs recording requests to /removeNode?id=1&group=0 or similar parameter combinations from non-loopback addresses.
• Process: Unexpected termination of the dgraph zero process; Alpha nodes entering a reconnection loop without a corresponding planned maintenance event.
• Cluster State: Unexpected changes in cluster membership or tablet assignments observable via /state that do not correspond to authorized administrative actions (GitHub Advisory).

Upgrade Dgraph to version 25.4.0 or later, which introduces an adminAuthHandler middleware that enforces authentication on all Zero administrative HTTP endpoints. In v25.4.0, /removeNode and /moveTablet are always guarded (strict mode) — only loopback callers are admitted by default; /state and /assign enforce auth once a token or whitelist is configured. As an immediate workaround prior to patching, restrict network access to port 6080 using firewall rules or network segmentation to allow only authorized administrative hosts, or disable the administrative interface entirely by setting --limit "disable-admin-http=true". Operators who need remote admin access after upgrading must configure --security "whitelist=<IP ranges>;token=<secret>" on Zero (GitHub Advisory, Release v25.4.0, Patch Commit).

The vulnerability was reported by researcher 0d000721999 and published as a GitHub Security Advisory (GHSA-qj98-gp63-54xj) by maintainer matthewmcneely. The fix was implemented collaboratively and merged into the main branch, with the release notes explicitly warning operators that /removeNode and /moveTablet behavior has changed and that remote administrative access now requires explicit --security configuration (GitHub Advisory, Release v25.4.0). No significant broader media coverage or social media discussion has been identified at this time.