9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41492

CVE-2026-41492: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41492

CVE-2026-41492:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/dgraph-io/dgraph/v25	go	< 25.3.3	25.3.3
github.com/dgraph-io/dgraph/v24	go	<= 24.1.8
github.com/dgraph-io/dgraph	go	<= 1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability (GHSA-vvf7-6rmr-m29q) lies in the use of Go's default HTTP server multiplexer, http.DefaultServeMux, across multiple components of Dgraph (alpha, bulk loader, live loader, and debug tools). The Go expvar package, which is imported by Dgraph for metrics, automatically registers a handler on this default multiplexer at the /debug/vars path.

This handler, by default, exposes sensitive process information, including the full command-line arguments used to start the Dgraph process. It is a common practice to provide the admin authentication token via a command-line flag (e.g., --security "token=..."). Consequently, any unauthenticated user with network access to the Dgraph HTTP port could make a GET request to the /debug/vars endpoint and retrieve the admin token from the cmdline field in the JSON response.

This vulnerability is a variant of a previously patched issue that only blocked the /debug/pprof/cmdline endpoint, leaving the /debug/vars endpoint exposed. An attacker could then use the leaked token to gain full administrative access to the Dgraph instance.

The patch addresses this by introducing a custom, sanitized HTTP handler function, x.SanitizedDefaultServeMux. This new handler wraps the default multiplexer and implements two key security checks:

It explicitly blocks requests to /debug/pprof/cmdline.
It provides a custom handler for /debug/vars (filteredExpvarHandler) that deliberately filters out and omits the cmdline key from the JSON output, preventing the token from being exposed.

This sanitized handler is then applied to all HTTP servers started by the various Dgraph components, effectively closing the information disclosure vector across the entire application.

Vulnerable functions

setupServer.func1

dgraph/cmd/alpha/run.go

The anonymous HTTP handler function within `setupServer` was vulnerable. It used `http.DefaultServeMux`, which, when the `expvar` package is imported, exposes process command-line arguments via the `/debug/vars` endpoint. This allowed unauthenticated attackers to retrieve the admin token if it was passed as a command-line argument. The original fix for a similar vulnerability only blocked `/debug/pprof/cmdline`, but not the `/debug/vars` endpoint.

RunBulkLoader

dgraph/cmd/bulk/run.go

The bulk loader component starts an HTTP server using `http.ListenAndServe` with a `nil` handler, which defaults to using `http.DefaultServeMux`. This exposed the same `/debug/vars` vulnerability as the alpha server, potentially leaking the admin token.

run

dgraph/cmd/live/run.go

The live loader component starts an HTTP server using `http.ListenAndServe` with a `nil` handler, which defaults to using `http.DefaultServeMux`. This exposed the same `/debug/vars` vulnerability as the alpha server, potentially leaking the admin token.

run

dgraph/cmd/debug/run.go

The debug utility starts an HTTP server using `http.ListenAndServe` with a `nil` handler, which defaults to using `http.DefaultServeMux`. This exposed the same `/debug/vars` vulnerability as the alpha server, potentially leaking the admin token.

buildUpsertQuery

edgraph/server.go

This function was vulnerable to DQL injection. It constructed an upsert query using a `cond` field from the user request without proper validation. A malicious user could craft a `cond` value that closes the intended conditional statement and injects an additional query block, allowing for unauthorized data exfiltration. The patch adds a call to the new `validateCondValue` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.