CVE-2026-102748

Executive Summary

CVE-2026-102748 is a critical missing authentication vulnerability in Dgraph Zero, the control-plane component of the open-source distributed GraphQL database Dgraph. In versions prior to 25.4.0, when the administrative interface is enabled, Dgraph Zero registers administrative HTTP routes on port 6080 without requiring authentication. A remote, unauthenticated attacker who can reach the Zero HTTP port can read cluster topology, allocate identifiers, access the /moveTablet administrative route, and remove cluster membership via /removeNode, disrupting the Zero control plane and destabilizing dependent Alpha nodes. Organizations running self-managed Dgraph deployments with an exposed Zero administrative interface (typically port 6080) are affected.

Technical Analysis

Dgraph is a distributed GraphQL database composed of two principal node types: Zero nodes, which manage cluster membership, ID allocation, and tablet placement (the control plane), and Alpha nodes, which store and serve data. The vulnerability CVE-2026-102748 is classified under CWE-306 (Missing Authentication for Critical Function) and affects Dgraph Zero prior to version 25.4.0.

According to the NVD description, when the administrative interface is enabled, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication. This means the control-plane HTTP handlers are reachable by any network client that can establish a TCP connection to the Zero HTTP port — no credentials, session tokens, or prior authorization are required. The route registration logic occurs in dgraph/cmd/zero/run.go.

The exposed administrative routes enumerated in the description include:

• /state — allows reading cluster topology. This exposes the internal layout of the Dgraph cluster to an unauthenticated reader.
• /assign — allows allocating identifiers. Identifier allocation is a core control-plane function; unauthenticated access permits an attacker to consume or manipulate UID allocation.
• /moveTablet — an administrative route for tablet movement. The description states it is "exposed," meaning it is reachable without authentication.
• /removeNode — accepts attacker-controlled id and group values. These values are passed to Server.RemoveNode. Where the group value is 0, the call can trigger ProposePeerRemoval.

The demonstrated membership-removal path therefore proceeds from an unauthenticated HTTP request to /removeNode, through Server.RemoveNode, and into ProposePeerRemoval. Because Zero coordinates cluster membership and tablet placement, forced peer removal through this path can desynchronize the cluster's view of its own membership. Alpha nodes depend on Zero for membership and placement metadata; disrupting Zero's control plane can therefore indirectly destabilize Alpha nodes.

The root cause is architectural: administrative HTTP endpoints on the Zero control plane were registered without an authentication middleware or authorization check. The fix in version 25.4.0 is described as addressing this issue; the specific implementation of the fix (for example, whether authentication was added to route registration, or the routes were gated behind a flag) is not detailed in the available data, and no patch diff was independently confirmed.

No public proof-of-concept, exploit code, or Nuclei template was identified at the time of reporting. EPSS is 0.00486 (40.4th percentile), indicating a low modeled probability of exploitation activity in the near term, but EPSS is a probabilistic score and does not preclude targeted exploitation of exposed control planes.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-306, missing authentication for a critical function) and the specific routes and code paths named in the NVD description.

1. Reconnaissance / target identification. An attacker scans for hosts exposing TCP port 6080, the Dgraph Zero HTTP administrative interface. Identification can be performed by probing the port and requesting an unauthenticated administrative route such as /state. Because no authentication is enforced on these routes in affected versions, a successful response to /state confirms an exposed and reachable Zero control plane and simultaneously leaks cluster topology.

2. Triggering the flaw class. The attacker does not need to bypass, guess, or steal credentials; the missing authentication control (CWE-306) means the administrative routes are directly reachable. The attacker sends an HTTP request directly to the Zero HTTP port for any of the exposed routes. For the identifier allocation route, the attacker issues a request to /assign. For the tablet administrative route, the attacker issues a request to /moveTablet.

3. Payload / execution method at the vulnerability-class level. For membership removal, the attacker issues a request to /removeNode supplying attacker-controlled id and group values. The description states these values are passed to Server.RemoveNode, and that group value 0 can trigger ProposePeerRemoval. The attacker controls the id and group parameters, meaning they choose the target node identifier and group. Where group is set to 0, the removal path reaches ProposePeerRemoval, initiating removal of a peer from the cluster membership. No authentication is required to reach this code path.

4. Post-exploitation impact. Successful abuse disrupts the Zero control plane. Reading /state exposes topology; using /assign permits identifier allocation; /moveTablet is exposed as an administrative route; and /removeNode can remove cluster membership through ProposePeerRemoval. Because Alpha nodes depend on Zero for membership and placement information, destabilizing Zero can propagate instability to Alpha nodes, degrading database availability and cluster consistency. The exact downstream effects on data integrity from tablet movement via the exposed /moveTablet route are not detailed in the available description and are not asserted here.

Note on limits: the description does not specify request body formats, parameter encodings, or response codes for these routes. Those specifics are not fabricated here. Any reproduction should be performed only against systems the tester is authorized to assess.

Impact Assessment

Confidentiality: The /state route exposes cluster topology without authentication, allowing an unauthenticated reader to learn cluster structure. Integrity: Attacker-controlled id and group values reach Server.RemoveNode, and group 0 can trigger ProposePeerRemoval; identifier allocation via /assign and tablet movement via /moveTablet are also reachable, allowing manipulation of control-plane state. Availability: Unauthenticated membership removal disrupts Zero's control plane and can destabilize dependent Alpha nodes. Scope: The vulnerability is confined to the Dgraph Zero control plane component, but its effects propagate to Alpha nodes that depend on Zero.

The vendor/product for this CVE is recorded as Unknown in the provided intelligence data, while the NVD description identifies the affected product as Dgraph Zero. Business impact is highest for organizations running self-managed Dgraph clusters where the Zero HTTP port (6080) is reachable from untrusted networks or lateral-movement paths. Blast radius includes the entire cluster dependent on the affected Zero quorum. CVSS is not assigned (N/A) in the provided data; the vector listed in metadata reflects a default critical-severity pre-auth impact profile and is not a source-assigned score.

Detection Guidance

Sigma Rule

title: Dgraph Zero Unauthenticated Administrative Route Access (CVE-2026-102748)
id: 8f2c1a44-7b9e-4d21-a6c3-dgraphzero0001
status: experimental
description: Detects HTTP requests to unauthenticated Dgraph Zero administrative routes on port 6080, including removal, assignment, and topology endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102748
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: dgraph
detection:
  selection_port:
    dst_port: 6080
  selection_route:
    cs-uri-stem|contains:
      - '/removeNode'
      - '/assign'
      - '/moveTablet'
      - '/state'
  condition: selection_port and selection_route
falsepositives:
  - Legitimate administrative tooling performing cluster maintenance against the Zero HTTP port
level: high
tags:
  - attack.t1190
  - cve.2026.102748

YARA Rule

rule CVE_2026_102748_Dgraph_Zero_Admin_Routes
{
    meta:
        description = "Detects references to unauthenticated Dgraph Zero administrative routes associated with CVE-2026-102748"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102748"
        cve = "CVE-2026-102748"

    strings:
        $route1 = "/removeNode" ascii wide nocase
        $route2 = "/moveTablet" ascii wide nocase
        $route3 = "/assign" ascii wide nocase
        $route4 = "/state" ascii wide nocase
        $code1  = "ProposePeerRemoval" ascii wide
        $code2  = "Server.RemoveNode" ascii wide

    condition:
        uint16(0) == 0x5A4D or (2 of ($route*) and 1 of ($code*))
}

Suricata IDS Rule

alert tcp any any -> any 6080 (msg:"CVE-2026-102748 Dgraph Zero Unauthenticated Administrative Route Access"; flow:established,to_server; content:"/removeNode"; http_uri; nocase; sid:2026102748; rev:1; classtype:attempted-admin; reference:cve,2026-102748; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102748;)

alert tcp any any -> any 6080 (msg:"CVE-2026-102748 Dgraph Zero Administrative Route Probe (/moveTablet /assign /state)"; flow:established,to_server; content:"/moveTablet"; http_uri; nocase; sid:2026102749; rev:1; classtype:attempted-recon; reference:cve,2026-102748;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where destination.port == 6080 and url.path in ("/state", "/assign", "/moveTablet") ]
  [ network where destination.port == 6080 and url.path == "/removeNode" ]

Splunk SPL Query

index=network OR index=proxy
| search dest_port=6080 OR uri_path IN ("/state","/assign","/moveTablet","/removeNode")
| eval cve="CVE-2026-102748"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as routes by src_ip dest_ip dest_port cve
| where count > 0

Wazuh OSSEC Rule

<group name="dgraph,cve-2026-102748,">
  <rule id="102748" level="12">
    <decoded_as>web-log</decoded_as>
    <url>/removeNode|/moveTablet|/assign|/state</url>
    <description>CVE-2026-102748: Possible unauthenticated Dgraph Zero administrative route access on port 6080</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102748,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The fix is reported in Dgraph version 25.4.0 per GHSA.

1. Immediate mitigations:

   • Do not expose the Dgraph Zero HTTP administrative port (6080) to untrusted networks. Restrict access using network ACLs, firewall rules, or security groups so that only trusted administrative hosts can reach the port.
   • Where the administrative interface is not required, disable it so that the administrative routes are not registered.
   • Place Zero nodes on management networks segmented from application and public traffic, and enforce strict east-west controls to limit lateral movement to port 6080.
   • Monitor for requests to /removeNode, /moveTablet, /assign, and /state as indicators of attempted abuse.

2. Patch / upgrade steps:

   • Upgrade Dgraph to version 25.4.0 or later. Because the fix is currently claimed by a single source (GHSA) and is not independently confirmed, verify the fix against the official release before relying on it, and validate behavior in a staging cluster.
   • After upgrading, confirm the administrative routes require authentication (or are no longer reachable unauthenticated) by testing against a non-production instance.
   • Roll the upgrade across the Zero quorum carefully, ensuring quorum is maintained throughout.

3. Long-term hardening:

   • Adopt a default-deny posture for control-plane ports; management interfaces should never be internet-reachable.
   • Enforce authentication and authorization on all administrative endpoints as a design requirement, and include control-plane route coverage in security review.
   • Monitor published advisories for Dgraph Zero and track version currency; verify third-party patch claims before treating them as confirmed.
   • Implement detection coverage (network and host) for unauthenticated administrative route access across database control-plane components, not only Dgraph.

References

• NVD — CVE-2026-102748: https://nvd.nist.gov/vuln/detail/CVE-2026-102748
• GHSA (GitHub Security Advisory) — referenced as the single source claiming the fix in version 25.4.0
• Dgraph project: https://github.com/dgraph-io/dgraph
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html

Threat actor and exploit-in-the-wild evidence: none available. CISA KEV status: NO. No public PoC or exploit code was identified at the time of reporting; EPSS is 0.00486 (40.4th percentile).