CVE-2026-41492: GO-2026-5675 - Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph

CVE-2026-41492 · Severity: critical · CVSS 9.8 · Published 2026-04-24

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.

Technologies: Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go), github.com/dgraph-io/dgraph/v25 (Go), github.com/hypermodeinc/dgraph/v24 (Go). Vendors: Dgraph, Go.

Quick answers

Is CVE-2026-41492 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41492 being exploited in the wild.
How severe is CVE-2026-41492?
Critical severity, with a CVSS score of 9.8, published 24 April 2026.
Which products and versions are affected?
github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8; github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.1.8; github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.3; github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=0,fixed=24.1.9.
Is there a fix for CVE-2026-41492?
Yes. github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.3 or later; github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-41492?
Check whether you run Dgraph, github.com/dgraph-io/dgraph (Go), github.com/dgraph-io/dgraph/v24 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/dgraph-io/dgraph/v25 (Go): upgrade to 25.3.3 or later
    go get github.com/dgraph-io/dgraph/v25@v25.3.3
  • github.com/hypermodeinc/dgraph/v24 (Go): upgrade to 24.1.9 or later
    go get github.com/hypermodeinc/dgraph/v24@v24.1.9

Affected products

  • Dgraph
  • github.com/dgraph-io/dgraph (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.2.8
  • github.com/dgraph-io/dgraph/v24 (Go) SEMVER:introduced=0,last_affected=24.1.8
  • github.com/dgraph-io/dgraph/v25 (Go) SEMVER:introduced=0,fixed=25.3.3
  • github.com/hypermodeinc/dgraph/v24 (Go) SEMVER:introduced=0,fixed=24.1.9

Identifiers

  • CVE-2026-41492
  • GHSA-vvf7-6rmr-m29q
  • GO-2026-5675

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.