CVE-2026-63637

In Dgraph prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval.

Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.

In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

Dgraph is a distributed GraphQL database. Existing audit logs are vulnerable to brute force attacks due to nonce collisions — the first 12 bytes come from a baseIv and the last 4 bytes from the length of the encrypted log line, causing the same nonce to be reused many times. All audit logs generated by Dgraph versions <v23.0.0 are affected.