CVE-2026-41492: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
dgraph-io · dgraph
Affected: dgraph-io · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 87% of scored CVEs
DescriptionCVE.org
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- dgraph-io · dgraph< 25.3.3
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Dgraph <= 25.3.2 - Admin Token Disclosure · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- dgraph-io
- Published
- April 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-41492 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.