CVE-2026-41492 Details
Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
A vulnerability in Dgraph, an open-source distributed GraphQL database, allows unauthenticated access to the process command line through the /debug/vars endpoint on Alpha, prior to version 25.3.3. This exposure includes the admin token, which is typically passed via the --security 'token=...' startup flag. An unauthenticated attacker can retrieve this token and use it in the X-Dgraph-AuthToken header to access admin-only endpoints. This issue is a variant of a previously addressed vulnerability related to the /debug/pprof/cmdline endpoint, but the current fix is incomplete, as it only blocks the old CVE path while still serving the /debug/vars handler.
Users should update to Dgraph version 25.3.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 | [email protected] | Release Notes |
| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dgraph dgraph | < 25.3.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |