GO-2026-5675
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
At a glance
- Published
- Updated
- CVE
- CVE-2026-41492
- Aliases
- GHSA-vvf7-6rmr-m29q
Description
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.3 |
| Go · github.com/hypermodeinc/dgraph/v24 | introduced 0, fixed 24.1.9 |
References
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q ADVISORY
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |