Critical Dgraph Flaw Leaks Admin Tokens, Bypassing Authentication

A critical unauthenticated credential disclosure vulnerability, tracked as CVE-2026-40173, has been identified in Dgraph, the open-source distributed GraphQL database. According to the National Vulnerability Database, versions 25.3.1 and earlier are susceptible to this flaw, which could grant unauthorized administrative access.

The core of the issue lies in Dgraph’s /debug/pprof/cmdline endpoint. This endpoint, registered on the default mux, is accessible without any authentication. It inadvertently exposes the full process command line, which critically includes the admin token configured via the --security "token=..." startup flag. An attacker can simply retrieve this leaked token and then reuse it in the X-Dgraph-AuthToken header to access admin-only endpoints, such as /admin/config/cache_mb. This effectively bypasses Dgraph’s adminAuthHandler token validation, handing over privileged administrative control, including configuration modifications and operational actions.

The impact is severe for any deployment where the Alpha HTTP port is reachable by untrusted parties. The National Vulnerability Database has assigned this a CVSS score of 9.4 (CRITICAL). Fortunately, Dgraph has addressed this security hole in version 25.3.2, and users are strongly advised to upgrade immediately.