Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable. The exposed routes include: - /state - /assign - /removeNode - /moveTablet An unauthenticated request to /removeNode?id=1&group=0 on a single-node standalone deployment breaks the Zero control plane and leaves Alpha repeatedly failing to reconnect to localhost:5080. Details The issue exists because Zero administrative HTTP endpoints are registered directly without any authentication or IP-whitelist wrapper. Relevant code paths: - worker/serverstate.go:41 - dgraph/cmd/zero/run.go:295-301 - dgraph/cmd/zero/http.go:106-129 - dgraph/cmd/zero/zero.go:475-477 The relevant behavior is: - disable-admin-http=false by default - /removeNode accepts attacker-controlled id and group - removeNode forwards those directly into Server.RemoveNode - for group=0, Server.RemoveNode immediately calls ProposePeerRemoval This means a remote unauthenticated caller can directly trigger…
Recommended action: Upgrade to 25.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The checkUserPassword GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL checkpwd() query via fmt.Sprintf without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Details Vulnerable Code Path The vulnerability exists in the GraphQL-to-DQL query rewriting layer: 1. queryrewriter.go (~line 364) — The checkpwd() DQL function is constructed using fmt.Sprintf: The raw password string from the GraphQL query input is embedded directly into the DQL query without escaping double quotes or other special characters. 2. graphquery.go — The constructed query attribute is serialized into the final DQL string via b.WriteString(query.Attr), passing the unsanitized content directly to the Dgraph query engine. Attack Mechanism A password value containing a double-quote…
Recommended action: Upgrade to 25.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.