https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:12:41.404762+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292970 EUVD-2026-292970 2026-10-06T15:12:41.695362+00:00 EUVD-2026-292970 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41492 fkie_cve-2026-41492 2026-10-06T15:12:41.695399+00:00

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.

 https://cve.radiocsirt.org/vuln/ghsa-vvf7-6rmr-m29q GHSA-vvf7-6rmr-m29q — Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars 2026-10-06T15:12:41.695434+00:00

Affected: Go: github.com/dgraph-io/dgraph/v25, Go: github.com/dgraph-io/dgraph/v24, Go: github.com/dgraph-io/dgraph

### Summary Dgraph `v25.3.2` still exposes the process command line through the unauthenticated `/debug/vars` endpoint on Alpha. Because the admin token is commonly supplied via the `--security "token=..."` startup flag, an unauthenticated attacker can retrieve that token and replay it in the `X-Dgraph-AuthToken` header to access admin-only endpoints.

This is a variant of the previously fixed `/debug/pprof/cmdline` issue, but the current fix is incomplete because it blocks only `/debug/pprof/cmdline` and still serves `http.DefaultServeMux`, which includes `expvar`'s `/debug/vars` handler.

### Details Alpha still exposes Go's default HTTP mux:

- `x/metrics.go` - imports `expvar` - initializes `Conf = expvar.NewMap("dgraph_config")` - Go's `expvar` package automatically registers `/debug/vars` - `expvar` publishes: - `cmdline = os.Args` - `memstats = runtime.Memstats`

Alpha's HTTP handler explicitly blocks only the old CVE path:

- `dgraph/cmd/alpha/run.go` - checks `if r.URL.Path == "/debug/pprof/cmdline"` and returns `404` - otherwise falls through to `http.DefaultServeMux.ServeHTTP(w, r)`

Admin endpoints still trust the leaked token:

- `dgraph/cmd/alpha/admin.go` - reads `X-Dgraph-AuthToken` - compares it to `worker.Config.AuthToken` ### PoC 1. Send an unauthenticated request to Alpha:

```http GET /debug/vars HTTP/1.1 Host: target:8080 ```

2. Parse the JSON response and read the `cmdline` field.

3. Extract the admin token from the startup arguments,…