CVE-2026-102748

{
  "etk_id": "ETK-2026-1600",
  "cve_id": "CVE-2026-102748",
  "display_id": "CVE-2026-102748",
  "ghsa_id": "GHSA-qj98-gp63-54xj",
  "euvd_id": "EUVD-2026-101603",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated administrative API access in Dgraph Zero",
  "summary": "Dgraph installations before 25.4.0 may expose Dgraph Zero administrative HTTP endpoints without authentication when the administrative interface is enabled. An unauthenticated remote attacker who can reach the Zero HTTP port can access administrative operations and disrupt cluster membership or the Zero control plane.",
  "mitigation": "Upgrade dgraph to version 25.4.0 or later. Until upgraded, disable the Zero administrative interface or restrict access to its HTTP port to trusted management networks.",
  "vendor": "dgraph-io",
  "product": "dgraph",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=25.3.8"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v25.4.0"
      ],
      "package_name": "github.com/dgraph-io/dgraph/v25",
      "purl": "pkg:golang/github.com/dgraph-io/dgraph/v25"
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H",
  "epss_score": 0.0049,
  "epss_percentile": 0.4058,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.025384666666667,
  "t0_at": "2026-10-14T18:34:15.971000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-08-02T16:38:34+00:00",
      "days": -73.08034688657408,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:34:15.971000+00:00",
      "url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-qj98-gp63-54xj"
    },
    "trigger_signal": {
      "at": "2026-10-14T18:34:15.971000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T18:34:15.971000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102748"
    }
  }
}