Command Line Exposure in Dgraph Database by Dgraph.io
CVE-2026-41492

9.8CRITICAL

Key Information:

Vendor

Dgraph-io

Status
Dgraph
Vendor
CVE Published:
24 April 2026

What is CVE-2026-41492?

Dgraph, an open-source distributed GraphQL database, has a vulnerability that allows unauthorized users to access sensitive command line parameters via the unauthenticated /debug/vars endpoint on Alpha before version 25.3.3. With knowledge of the admin token often passed as a startup flag, an attacker can exploit this weakness to retrieve the token and gain unauthorized access to admin endpoints by replaying it in the X-Dgraph-AuthToken header. Despite prior fixes addressing similar issues, this vulnerability persists due to incomplete remediation, as access to the http.DefaultServeMux, which includes expvar's /debug/vars handler, remains unaffected.

Affected Version(s)

dgraph < 25.3.3

References

https://github.com/dgraph-io/dgraph/security/advisories/G...
x_refsource_CONFIRM
https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.