Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone

Dgraph, the horizontally scalable and distributed GraphQL database known for its ACID transactions and graph-backend performance, is facing a significant security challenge. A recently disclosed critical vulnerability, tracked as CVE-2026-40173, has revealed a “cleartext” loophole that allows unauthenticated attackers to seize administrative control of the database.

The flaw carries a CVSS score of 9.4, reflecting the severe risk it poses to deployments where the database’s HTTP interface is exposed beyond trusted boundaries.

The core of the issue lies in a default configuration oversight within Dgraph Alpha. A core debug endpoint—/debug/pprof/cmdline—was found to be reachable without any authentication.

While debug endpoints are common in development, this specific route “exposes the full process command line, including the configured admin token from –security ‘token=…'”. This means that anyone with network access to the Alpha HTTP port can simply query the endpoint and see the “Top Secret” administrative credential in plain text.

The exploitation of this flaw does not require complex memory corruption or advanced exploits. Instead, it follows a simple, logical chain of credential disclosure:

1. An attacker accesses the unauthenticated /debug/pprof/cmdline route.
2. The output reveals the exact admin token used to start the process.
3. The attacker then sends this leaked token back to the server in the X-Dgraph-AuthToken header.
4. The server’s adminAuthHandler accepts the disclosed token, granting the attacker “unauthorized access to admin-only functionality”.

Once inside, depending on the deployment policy, an adversary could perform “configuration changes, operational control actions, and other privileged administrative operations” across all /admin/* endpoints.

The behavior is not a result of an external plugin or misconfiguration, but occurs “entirely within core Alpha HTTP routing”. Specifically, the code in dgraph/cmd/alpha/run.go imports net/http/pprof, which automatically registers handlers on the default mux. Because the system uses audit.AuditRequestHttp on the base mux, these default handlers remain reachable and exposed.

Researchers emphasized that “network restrictions (bind/whitelist/firewall) may reduce exposure, but they do not remediate the underlying credential disclosure behavior”.

Organizations running Dgraph are urged to check their version numbers immediately.

• Affected Versions: All versions up to and including v25.3.1.
• The Fix: A patch has been released in v25.3.2, which properly secures the debug routes.