CVE-2026-54061

{
  "id": "CVE-2026-54061",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T14:17:06.520",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue."
    },
    {
      "lang": "es",
      "value": "Dgraph es una base de datos GraphQL distribuida de código abierto. Antes de la versión 25.3.5, Dgraph Alpha expone los RPC utilizados para la importación de instantáneas externas en el puerto gRPC público ’:9080’ sin autenticación ni autorización. Como resultado, un cliente de red no autenticado puede abrir ’StreamExtSnapshot’ y enviar datos de flujo de Badger al almacén del grupo objetivo. Además, el receptor llama a ’Prepare()’ antes de procesar el flujo. Esta operación elimina y reemplaza los datos de DB existentes. La versión 25.3.5 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dgraph-io",
          "product": "dgraph",
          "versions": [
            {
              "version": "< 25.3.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T14:26:08.694479Z",
          "id": "CVE-2026-54061",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.5",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-rrwh-6jrq-wp5v",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}