Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.

Source published

24 Apr 2026 18:29:40 UTC

Source modified

24 Apr 2026 19:13:03 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.

Source published

24 Apr 2026 19:17:14 UTC

Source modified

25 Oct 2026 23:10:00 UTC

Observed here

27 Oct 2026 10:10:19 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Summary Dgraph `v25.3.2` still exposes the process command line through the unauthenticated `/debug/vars` endpoint on Alpha. Because the admin token is commonly supplied via the `--security "token=..."` startup flag, an unauthenticated attacker can retrieve that token and replay it in the `X-Dgraph-AuthToken` header to access admin-only endpoints. This is a variant of the previously fixed `/debug/pprof/cmdline` issue, but the current fix is incomplete because it blocks only `/debug/pprof/cmdline` and still serves `http.DefaultServeMux`, which includes `expvar`'s `/debug/vars` handler. ### Details Alpha still exposes Go's default HTTP mux: - `x/metrics.go` - imports `expvar` - initializes `Conf = expvar.NewMap("dgraph_config")` - Go's `expvar` package automatically registers `/debug/vars` - `expvar` publishes: - `cmdline = os.Args` - `memstats = runtime.Memstats` Alpha's HTTP handler explicitly blocks only the old CVE path: - `dgraph/cmd/alpha/run.go` - checks `if r.URL.Path == "/debug/pprof/cmdline"` and returns `404` - otherwise falls through to `http.DefaultServeMux.ServeHTTP(w, r)` Admin endpoints still trust the leaked token: - `dgraph/cmd/alpha/admin.go` - reads `X-Dgraph-AuthToken` - compares it to `worker.Config.AuthToken` ### PoC 1. Send an unauthenticated request to Alpha: ```http GET /debug/vars HTTP/1.1 Host: target:8080 ``` 2. Parse the JSON response and read the `cmdline` field. 3. Extract the admin token from the startup arguments, for example: ```text --security token=debug-vars-secret; ``` 4. Replay the token to an admin-only endpoint: ```http GET /admin/config/cache_mb HTTP/1.1 Host: target:8080 X-Dgraph-AuthToken: debug-vars-secret ``` 5. The request is accepted as an authorized admin request. This was reproduced against `dgraph/dgraph:v25.3.2` in Docker. Observed behavior: - unauthenticated `/debug/vars` leaked the configured token - replaying the leaked token in `X-Dgraph-AuthToken` successfully accessed `/admin/config/cache_mb` - response body was: ```text 4096 ``` It was verified that the old CVE path appears specifically patched in the same version: - `/debug/pprof/cmdline` returned `404 Not Found` - `/debug/pprof/` remained reachable ### Impact Unauthenticated attackers can obtain the Alpha admin token and gain unauthorized administrative access. This enables privileged admin operations such as: - reading privileged admin configuration - mutating admin configuration - performing operational control actions gated by `X-Dgraph-AuthToken` In deployments where the Alpha HTTP port is reachable by untrusted parties, this is a practical authentication bypass to admin functionality.

Source published

24 Apr 2026 16:15:28 UTC

Source modified

10 Sep 2026 03:51:03 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Publisher rating · CRITICAL

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

Source published

23 Jul 2026 17:20:08 UTC

Source modified

23 Jul 2026 17:45:22 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.