https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 14:03:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292970 EUVD-2026-292970 https://cve.radiocsirt.org/vuln/euvd-2026-292970 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41492 <p>Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security &#34;token=...&#34; startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar&#39;s /debug/vars handler. This vulnerability is fixed in 25.3.3.</p> <p>Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security &#34;token=...&#34; startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar&#39;s /debug/vars handler. This vulnerability is fixed in 25.3.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41492 https://cve.radiocsirt.org/vuln/ghsa-vvf7-6rmr-m29q <p><strong>Affected:</strong> Go: github.com/dgraph-io/dgraph/v25, Go: github.com/dgraph-io/dgraph/v24, Go: github.com/dgraph-io/dgraph</p> <p>### Summary Dgraph `v25.3.2` still exposes the process command line through the unauthenticated `/debug/vars` endpoint on Alpha. Because the admin token is commonly supplied via the `--security &#34;token=...&#34;` startup flag, an unauthenticated attacker can retrieve that token and replay it in the `X-Dgraph-AuthToken` header to access admin-only endpoints.</p> <p>This is a variant of the previously fixed `/debug/pprof/cmdline` issue, but the current fix is incomplete because it blocks only `/debug/pprof/cmdline` and still serves `http.DefaultServeMux`, which includes `expvar`&#39;s `/debug/vars` handler.</p> <p>### Details Alpha still exposes Go&#39;s default HTTP mux:</p> <p>- `x/metrics.go` - imports `expvar` - initializes `Conf = expvar.NewMap(&#34;dgraph_config&#34;)` - Go&#39;s `expvar` package automatically registers `/debug/vars` - `expvar` publishes: - `cmdline = os.Args` - `memstats = runtime.Memstats`</p> <p>Alpha&#39;s HTTP handler explicitly blocks only the old CVE path:</p> <p>- `dgraph/cmd/alpha/run.go` - checks `if r.URL.Path == &#34;/debug/pprof/cmdline&#34;` and returns `404` - otherwise falls through to `http.DefaultServeMux.ServeHTTP(w, r)`</p> <p>Admin endpoints still trust the leaked token:</p> <p>- `dgraph/cmd/alpha/admin.go` - reads `X-Dgraph-AuthToken` - compares it to `worker.Config.AuthToken` ### PoC 1. Send an unauthenticated request to Alpha:</p> <p>```http GET /debug/vars HTTP/1.1 Host: target:8080 ```</p> <p>2. Parse the JSON response and read the `cmdline` field.</p> <p>3. Extract the admin token from the startup arguments,…</p> <p><strong>Affected:</strong> Go: github.com/dgraph-io/dgraph/v25, Go: github.com/dgraph-io/dgraph/v24, Go: github.com/dgraph-io/dgraph</p> <p>### Summary Dgraph `v25.3.2` still exposes the process command line through the unauthenticated `/debug/vars` endpoint on Alpha. Because the admin token is commonly supplied via the `--security &#34;token=...&#34;` startup flag, an unauthenticated attacker can retrieve that token and replay it in the `X-Dgraph-AuthToken` header to access admin-only endpoints.</p> <p>This is a variant of the previously fixed `/debug/pprof/cmdline` issue, but the current fix is incomplete because it blocks only `/debug/pprof/cmdline` and still serves `http.DefaultServeMux`, which includes `expvar`&#39;s `/debug/vars` handler.</p> <p>### Details Alpha still exposes Go&#39;s default HTTP mux:</p> <p>- `x/metrics.go` - imports `expvar` - initializes `Conf = expvar.NewMap(&#34;dgraph_config&#34;)` - Go&#39;s `expvar` package automatically registers `/debug/vars` - `expvar` publishes: - `cmdline = os.Args` - `memstats = runtime.Memstats`</p> <p>Alpha&#39;s HTTP handler explicitly blocks only the old CVE path:</p> <p>- `dgraph/cmd/alpha/run.go` - checks `if r.URL.Path == &#34;/debug/pprof/cmdline&#34;` and returns `404` - otherwise falls through to `http.DefaultServeMux.ServeHTTP(w, r)`</p> <p>Admin endpoints still trust the leaked token:</p> <p>- `dgraph/cmd/alpha/admin.go` - reads `X-Dgraph-AuthToken` - compares it to `worker.Config.AuthToken` ### PoC 1. Send an unauthenticated request to Alpha:</p> <p>```http GET /debug/vars HTTP/1.1 Host: target:8080 ```</p> <p>2. Parse the JSON response and read the `cmdline` field.</p> <p>3. Extract the admin token from the startup arguments,…</p> https://cve.radiocsirt.org/vuln/ghsa-vvf7-6rmr-m29q