CVE-2026-40173 Details
Description
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve the leaked token and reuse it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints such as /admin/config/cache_mb, bypassing the adminAuthHandler token validation. This enables unauthorized privileged administrative access including configuration changes and operational control actions in any deployment where the Alpha HTTP port is reachable by untrusted parties. This issue has been fixed in version 25.3.2.
A vulnerability exists in Dgraph, an open-source distributed GraphQL database, in versions through 25.3.1. The issue is an unauthenticated credential disclosure, where the /debug/pprof/cmdline endpoint is accessible without authentication. This endpoint exposes the full process command line, including the admin token set via the --security 'token=...' startup flag. An attacker can retrieve this token and use it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints, such as /admin/config/cache_mb. This bypasses the token validation in the adminAuthHandler, allowing unauthorized privileged administrative access. The vulnerability is present in any deployment where the Alpha HTTP port is accessible to untrusted parties.
Users should upgrade to Dgraph version 25.3.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dgraph-io/dgraph/releases/tag/v25.3.2 | [email protected] | Release Notes |
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-215 | Insertion of Sensitive Information Into Debugging Code | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dgraph dgraph | < 25.3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 25, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | New CVE Received | [email protected] |