Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dgraph-io | dgraph | < 25.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | dgraph | 25.3.3-r0 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Dgraph <= 25.3.2 - Admin Token Disclosure http/cves/2026/CVE-2026-41492.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/dgraph-io/dgraph | <= 1.2.8 | — | GHSA-vvf7-6rmr-m29q |
| Go | github.com/dgraph-io/dgraph | all versions | — | GO-2026-5675 |
| Go | github.com/dgraph-io/dgraph/v24 | <= 24.1.8 | — | GHSA-vvf7-6rmr-m29q |
| Go | github.com/dgraph-io/dgraph/v25 | < 25.3.3 | 25.3.3 | GHSA-vvf7-6rmr-m29q |
| Go | github.com/hypermodeinc/dgraph/v24 | < 24.1.9 | 24.1.9 | GO-2026-5675 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026