GO-2026-6261

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6261

Import Source

https://vuln.go.dev/ID/GO-2026-6261.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6261

Aliases

Published

2026-08-25T19:43:14Z

Modified

2026-08-26T01:13:10Z

Summary

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

Details

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6261"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6261.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

25.3.5

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25/edgraph",
            "symbols": [
                "Server.StreamExtSnapshot",
                "Server.UpdateExtSnapshotStreamingState"
            ]
        },
        {
            "path": "github.com/dgraph-io/dgraph/v25/worker",
            "symbols": [
                "InStream"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6261.json"