CVE-2026-102748 dgraph-io CVE debrief

Who should care

Defenders responsible for Dgraph deployments, particularly those with exposed port 6080, should assess the vulnerability and implement necessary mitigations. They should prioritize verifying exposure of port 6080 and assessing the impact of unauthenticated access to the Zero HTTP administrative surface. Operators of Dgraph deployments should review their configurations and ensure that proper security measures are in place to prevent exploitation. Security

Why it matters

CVE-2026-102748 is a denial-of-service vulnerability in Dgraph's unauthenticated HTTP administrative interface. Defenders should prioritize verifying exposure of port 6080 and assessing the impact of unauthenticated access.

• Denial of service due to control plane disruption
• Potential for destructive membership operations
• Need for authentication or IP-whitelisting on administrative endpoints
• Verification of port 6080 exposure and access controls

Technical summary

The vulnerability exists in Dgraph's Zero HTTP administrative surface on port 6080. Unauthenticated endpoints include /state, /assign, /removeNode, and /moveTablet. An attacker can cause a denial-of-service by making a request to /removeNode?id=1&group=0, breaking the Zero control plane. The relevant behavior is: disable-admin-http=false by default, /removeNode accepts attacker-controlled id and group, removeNode forwards those directly into Server.RemoveNode, and for group=0, Server.RemoveNode immediately calls ProposePeerRemoval. This means a remote unauthenticated caller can directly trigger destructive membership operations if 6080 is exposed. The issue exists because Zero administrative HTTP endpoints are

Defensive priority

Defenders should prioritize verifying exposure of port 6080 and assessing the impact of unauthenticated access to the Zero HTTP administrative surface.

Recommended defensive actions

• Verify that port 6080 is not exposed to untrusted networks
• Assess the impact of unauthenticated access to the Zero HTTP administrative surface
• Implement authentication or IP-whitelisting for the administrative endpoints
• Monitor for suspicious activity on port 6080
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists due to unauthenticated HTTP administrative endpoints being registered directly without authentication or IP-whitelist wrapper. The /removeNode endpoint accepts attacker-controlled id and group parameters, which can trigger destructive membership operations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.