GO-2026-5675
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-41492
- Alias
- GHSA-vvf7-6rmr-m29q
Description
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/dgraph-io/dgraph | introduced 0 |
| Go · github.com/dgraph-io/dgraph/v25 | introduced 0, fixed 25.3.3 |
| Go · github.com/hypermodeinc/dgraph/v24 | introduced 0, fixed 24.1.9 |
Références
- https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q ADVISORY
- https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |