CyberRota Analysis
AI-GeneratedDgraph Alpha prior to version 25.3.5 is vulnerable due to the exposure of RPCs for external snapshot imports on the public gRPC port without authentication, allowing unauthenticated clients to overwrite existing database data. This critical vulnerability can lead to unauthorized data manipulation and potential data loss. Organizations using Dgraph should prioritize upgrading to version 25.3.5 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network client can open `StreamExtSnapshot` and send Badger stream data to the target group’s store. In addition, the receiver calls `Prepare()` before processing the stream. This operation deletes and replaces the existing DB data. Version 25.3.5 patches the issue.