Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/dgraph-io/dgraph/v24
  4. ›
  5. CVE-2026-40173

CVE-2026-40173: Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

April 16, 2026

An unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token from --security "token=...".

This does not break token validation logic directly; instead, it discloses the credential and enables unauthorized admin-level access by reusing the leaked token in X-Dgraph-AuthToken.

References

  • github.com/advisories/GHSA-95mq-xwj4-r47p
  • github.com/dgraph-io/dgraph
  • github.com/dgraph-io/dgraph/releases/tag/v25.3.2
  • github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p
  • nvd.nist.gov/vuln/detail/CVE-2026-40173

Code Behaviors & Features

Detect and mitigate CVE-2026-40173 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 24.1.7

Solution

Unfortunately, there is no solution available yet.

Impact 9.4 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Learn more about CVSS

Weakness

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-215: Insertion of Sensitive Information Into Debugging Code

Source file

go/github.com/dgraph-io/dgraph/v24/CVE-2026-40173.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:19:05 +0000.