Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gR…

CVE-2026-54061 affects Dgraph, an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes snapshot import RPCs on the public gRPC port 9080 without any authentication or authorization controls. An unauthenticated remote attacker can exploit this by calling StreamExtSnapshot to send arbitrary Badger stream data to the target group's data store. Before processing the stream, the receiver invokes Prepare(), which deletes and replaces all existing database data, enabling complete data destruction or replacement. This represents a critical data integrity and availability risk for any exposed Dgraph instance. The vulnerability has been patched in version 25.3.5. Users are strongly advised to upgrade immediately to mitigate the risk of unauthorized data manipulation or destruction.