Listen to this Post
Dgraph versions up to v25.3.8 expose a Zero HTTP administrative interface on port 6080 by default without any authentication or IP whitelist protection mechanisms.
The administrative routes, including /state, /assign, /removeNode, and /moveTablet, are registered directly during server initialization without access controls.
Because `disable-admin-http` is set to `false` out-of-the-box, remote unauthenticated attackers can access these management endpoints directly over the network if port 6080 is reachable.
Specifically, the `/removeNode` endpoint accepts attacker-controlled `id` and `group` query parameters without verifying the caller’s identity or administrative privileges.
When a request is submitted to /removeNode?id=1&group=0, the parameters are passed directly into the internal `Server.RemoveNode` function handler.
For group=0, `Server.RemoveNode` immediately triggers ProposePeerRemoval, initiating a destructive cluster membership removal process.
This unauthenticated remote manipulation severely disrupts the Zero control plane, causing connection resets and leading to persistent errors where Alpha nodes fail to reconnect to localhost:5080, effectively causing a remote denial of service against the database infrastructure.
DailyCVE Form:
Platform: Dgraph
Version: v25.3.8
Vulnerability: Administrative route exposure
Severity: Critical
date: October 2026
Prediction: Patched in 25.4.0
What Undercode Say:
Bash Commands And Code Analytics
Read state without authentication:
curl -i http://127.0.0.1:6080/state
Write-capable route without authentication:
curl -i 'http://127.0.0.1:6080/assign?what=nsids&num=1'
Destructive unauthenticated removeNode execution:
curl -i 'http://127.0.0.1:6080/removeNode?id=1&group=0'
Relevant code paths:
`worker/server_state.go:41`
`dgraph/cmd/zero/run.go:295-301`
`dgraph/cmd/zero/http.go:106-129`
`dgraph/cmd/zero/zero.go:475-477`
Exploit: (Educational Purposes!)
An unauthenticated remote attacker who can reach port 6080 can query cluster topology, allocate IDs, and invoke destructive administrative endpoints such as /removeNode?id=1&group=0. This forces `ProposePeerRemoval` execution, breaking the control plane and disrupting Alpha node connectivity.
Protection: from this CVE
Upgrade Dgraph to version 25.4.0 or later where administrative route exposure is properly restricted. Ensure port 6080 is never exposed publicly to untrusted networks and restrict administrative interface access using firewalls or IP whitelisting.
Impact:
Complete exposure of internal cluster topology, unauthorized ID/timestamp allocation, execution of destructive membership removal actions, and remote denial of service against the Zero control plane and depending Alpha nodes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
