CVE-2026-102748

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval. This issue is fixed in version 25.4.0.

• CWE-306
• CWE-862

• https://github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1
• https://github.com/dgraph-io/dgraph/releases/tag/v25.4.0
• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10273A vulnerability was found in php-censor up to 2.1.6. This af…7.3
• CVE-2026-102730Mounting an attacker-controlled NAND flash image (`lx_nand_f…8.6
• CVE-2026-102731Memory allocation with excessive size value vulnerability in…7.5
• CVE-2026-102734asteval is a Python expression evaluator designed for restri…5.5
• CVE-2026-10274A vulnerability was determined in indrasishbanerjee aem-mcp-…6.3
• CVE-2026-102740The AsyncHttpClient library allows Java applications to exec…5.8
• CVE-2026-10275A flaw has been found in OpenSC up to 0.26.1. This affects t…5
• CVE-2026-102755DataEase is an open source data visualization and analysis t…5.1
• CVE-2026-102756DataEase is an open source data visualization and analysis t…5.1
• CVE-2026-102757An unprivileged, memory-protected ThreadX module can have th…8.5
• CVE-2026-102758The `_nx_secure_x509_asn1_tlv_block_parse()` function parses…7.5
• CVE-2026-102759NetX Secure TLS accepts an empty application-data record wit…6.3