CVE-2026-54061 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
Unauthenticated attackers can replace Dgraph Alpha group stores via external snapshot import, leading to data loss and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54061?
CVE-2026-54061 is a critical missing authorization vulnerability in dgraph-io dgraph, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.
Weakness: CWE-306
Which versions are affected by CVE-2026-54061?
4 open source packages ship an affected version, including github.com/dgraph-io/dgraph/v25 and github.com/dgraph-io/dgraph.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.5 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.5 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.5 |
github.com/dgraph-io/dgraph Go | All versions | None |
How do I fix CVE-2026-54061?
Upgrade github.com/dgraph-io/dgraph/v25 to 25.3.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54061 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54061 exists.
Sources
Also known as GHSA-rrwh-6jrq-wp5v, GO-2026-6261.