CVE-2026-41492
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.
Beschreibung
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24, github.com/dgraph-io/dgraph/v25 | 25.3.3 |
| chainguard | dgraph | 25.3.3-r0 |
| wolfi | dgraph | 25.3.3-r0 |
Alle 5 Einträge aus 3 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph | kein Fix angegeben |
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph/v24 | kein Fix angegeben |
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph/v25 | 25.3.3 |
| chainguard | dgraph | 25.3.3-r0 |
| wolfi | dgraph | 25.3.3-r0 |