Dgraph Alpha: Unauthenticated gRPC Import RPC Allows Attackers to Wipe or Replace Group Stores (CVE-2026-54061)

A newly published GitHub Security Advisory (GHSA-rrwh-6jrq-wp5v, tracked as CVE-2026-54061, CVSS 9.1) reports that Dgraph Alpha's public gRPC port (default :9080) exposes the StreamExtSnapshot RPC used for external snapshot import without any authentication or authorization check. According to the advisory, streaming RPCs lack a stream interceptor and the handler itself performs no auth check, so any network client that can reach the gRPC port can open the stream and trigger it — no ACL token, JWT, or auth-token metadata required.

The advisory describes the server calling Badger's StreamWriter.Prepare() before consuming the incoming stream, which deletes the existing store for the targeted group. A proof-of-concept in the advisory shows that even a "done-only" stream (no data chunks) is enough to clear a group's data; the advisory notes that supplying valid Badger stream chunks before the Done packet could instead replace the store with attacker-controlled data.

Why It Matters

Per the advisory, this affects any reachable Dgraph Alpha instance where public gRPC mTLS is not enabled. The impact is significant: an unauthenticated attacker can destroy or overwrite a group's stored data. The advisory specifically calls out that in ACL-enabled deployments, group 1 holds Dgraph's ACL/internal predicates — so replacing that group's store could also lead to privilege escalation, not just data loss or destruction.

What Defenders Should Do Now

• Identify any Dgraph Alpha instances (github.com/dgraph-io/dgraph/v25) with gRPC port 9080 (or configured equivalent) reachable from untrusted networks, including internal segments that may not be as trusted as assumed.
• Enable gRPC mTLS and/or Dgraph ACL/auth-token enforcement on the Alpha gRPC endpoint as the advisory's suggested mitigations point toward requiring authorization before streaming/import operations.
• Restrict network exposure of the gRPC port to known, authorized clients (import tooling, cluster peers) via firewalling or network segmentation until a patched release enforcing authorization on StreamExtSnapshot/UpdateExtSnapshotStreamingState is available and applied.
• For hunting: watch for unexpected or unauthenticated gRPC connections invoking the external snapshot import flow, and monitor for unexplained data loss/replacement events in group stores as a potential indicator of exploitation.
• Given the public PoC status noted in the advisory, treat internet- or broadly-network-reachable Alpha gRPC ports as an urgent exposure to close first, ahead of a full patch rollout.

This is developing intel based on a same-day GHSA publication; details on affected version ranges and an official fix were not fully specified in the material reviewed here. Defenders should consult the original advisory directly for the latest remediation guidance: GHSA-rrwh-6jrq-wp5v.