—
GO-2026-6261
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph
Quick fix
GO-2026-6261 — github.com/dgraph-io/dgraph/v25: upgrade to the fixed version with the command below.
go get github.com/dgraph-io/dgraph/v25@v25.3.5Details
Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing database data.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/dgraph-io/dgraph
Introduced in:
0No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
Go/github.com/dgraph-io/dgraph/v25
Introduced in:
0Fixed in: 25.3.5Fix
go get github.com/dgraph-io/dgraph/v25@v25.3.5