CVE-2026-41492
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.
Descripción
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24, github.com/dgraph-io/dgraph/v25 | 25.3.3 |
| chainguard | dgraph | 25.3.3-r0 |
| wolfi | dgraph | 25.3.3-r0 |
Mostrar las 5 entradas de 3 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph/v24 | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/dgraph-io/dgraph/v25 | 25.3.3 |
| chainguard | dgraph | 25.3.3-r0 |
| wolfi | dgraph | 25.3.3-r0 |