Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M
CVE-2026-41492Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
Critical 9.8
In plain English
A critical-severity information exposure in dgraph from dgraph-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/dgraph-io/dgraph | no fix listed | GHSA-vvf7-6rmr-m29q |
| Go | github.com/dgraph-io/dgraph | no fix listed | GO-2026-5675 |
| Go | github.com/dgraph-io/dgraph/v24 | no fix listed | GHSA-vvf7-6rmr-m29q |
| Go | github.com/dgraph-io/dgraph/v25 | 25.3.3 | GHSA-vvf7-6rmr-m29q |
| Go | github.com/dgraph-io/dgraph/v25 | 25.3.3 | GO-2026-5675 |
| Go | github.com/hypermodeinc/dgraph/v24 | 24.1.9 | GO-2026-5675 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q x_refsource_CONFIRM
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 x_refsource_MISC