CVE-2026-102748: CWE-306: Missing Authentication for Critical Function in dgraph-io dgraph

Dgraph, an open source distributed GraphQL database, has a missing authentication vulnerability (CWE-306) in its administrative HTTP routes on port 6080 prior to version 25.4.0. The /removeNode route accepts attacker-controlled parameters that can trigger membership removal operations, including ProposePeerRemoval. Other exposed routes like /state, /assign, and /moveTablet allow unauthenticated remote attackers to read topology, allocate identifiers, and move tablets, respectively. This can disrupt the Zero control plane and destabilize dependent Alpha nodes. The vulnerability is addressed by requiring authentication or disabling the administrative interface in version 25.4.0.

A remote unauthenticated attacker who can access the Zero HTTP port can disrupt the Dgraph Zero control plane by removing membership nodes, reading topology information, allocating identifiers, and moving tablets. This disruption can destabilize Alpha nodes that rely on Zero, potentially causing denial of service or operational instability in the database cluster. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity.

Upgrade Dgraph to version 25.4.0 or later, where this vulnerability is fixed by enforcing authentication on administrative HTTP routes. Until upgrading, restrict network access to the Zero HTTP port (6080) to trusted administrators only to prevent unauthenticated remote access.