Critical Zero-Day Vulnerability in Dgraph Exposes Databases to Remote Takeover A maximum-severity flaw (CVE-2026-34976, CVSS 10.0) in Dgraph, a widely used open-source graph database, allows unauthenticated attackers to bypass all security controls, overwrite databases, exfiltrate sensitive files, and launch Server-Side Request Forgery (SSRF) attacks. The vulnerability was discovered by security researchers Matthew McNeely and Koda Reef and stems from a missing authorization check in Dgraph’s GraphQL administration API. The issue lies in the restoreTenant command, which was accidentally excluded from Dgraph’s security middleware (dubbed the “Guardian of the Galaxy” auth). Without authentication or IP restrictions, attackers can exploit this oversight to trigger the command remotely, enabling multiple attack vectors: - Database Overwrite: Attackers can force Dgraph to fetch a malicious backup from a public cloud storage (e.g., Amazon S3) and replace the entire database. - Local File Theft: By supplying file:// paths, attackers can read sensitive server files, including password hashes and Kubernetes tokens. - SSRF Attacks: The flaw allows outbound requests to internal networks or cloud metadata endpoints, exposing protected services. The vulnerability affects Dgraph versions 25.3.0 and older, posing a catastrophic risk to organizations with exposed admin endpoints (typically port 8080). Exploitation requires no credentials or user interaction, making it highly dangerous. While a fix is straightforward adding restoreTenant to the security middleware no official patch has been released at the time of disclosure. Until a patch is available, organizations are advised to isolate Dgraph admin ports from the public internet and restrict access to trusted IPs. The flaw underscores the critical need for rigorous authorization checks in administrative APIs.