Executive brief
Dgraph Alpha, a distributed graph database, exposes snapshot import functionality on its public network port without requiring authentication or authorization. An unauthenticated attacker with network access can clear an entire database group or replace it with attacker-controlled data, causing complete data loss and potential privilege escalation in systems using access control lists.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the StreamExtSnapshot gRPC streaming RPC handler. The RPCs used for external snapshot import are exposed through Alpha's public gRPC service on port 9080, but no administrator authorization verification occurs before destructive storage operations. Streaming RPCs lack a stream interceptor, and handlers do not perform authorization checks. An unauthenticated client that can reach the public gRPC port can initiate the import flow without prior state setup. Dgraph calls Badger's StreamWriter.Prepare() on the target group store, which deletes the existing database before consuming stream packets. An attacker can send an empty stream (Done flag only) to clear a group, or send valid Badger stream chunks to replace it with attacker data. In ACL-enabled deployments, group 1 contains ACL and internal predicates, enabling privilege escalation via replacement. No user interaction is required; the attack requires only network reachability to port 9080 and absence of mTLS or auth-token configuration.
Affected products
- Dgraph Dgraph <= 25.3.4
Timeline
- 2026-08-20: disclosed: Advisory published by GitHub
- 2026-08: patched: Patch released in version 25.3.5