CVE-2026-102748: Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

October 15, 2026

Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable.

The exposed routes include:

/state
/assign
/removeNode
/moveTablet

An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to localhost:5080.

References

github.com/advisories/GHSA-qj98-gp63-54xj
github.com/dgraph-io/dgraph/commit/c32f6041387fa631dbc057e265b71aec3384ead1
github.com/dgraph-io/dgraph/releases/tag/v25.4.0
github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj
nvd.nist.gov/vuln/detail/CVE-2026-102748

Code Behaviors & Features

Detect and mitigate CVE-2026-102748 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →