Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

The primary impact of CVE-2026-40173 is the unauthorized disclosure of the Dgraph Alpha admin token. While the token validation logic itself remains intact, the exposure of this credential bypasses authentication entirely. An attacker can simply reuse the leaked token in the X-Dgraph-AuthToken header to gain full administrative privileges. This grants them the ability to read, write, and delete data, modify the Dgraph configuration, and potentially compromise the entire system. The lack of authentication required for accessing the debug endpoint significantly broadens the attack surface, making exploitation trivial. This vulnerability is similar in impact to credential leakage vulnerabilities found in other database systems, where exposed credentials can lead to complete system takeover.

Organizations utilizing Dgraph Alpha in production environments, particularly those relying on the admin token for access control, are at significant risk. Deployments with default configurations or those that have not implemented robust security practices are especially vulnerable. Shared hosting environments where multiple users share a Dgraph instance are also at increased risk.

• linux / server:

journalctl -u dgraph -g "debug endpoint"

• generic web:

curl -I http://<dgraph_alpha_ip>:8080/_debug/ | grep -i "X-Dgraph-AuthToken"

1. 2026-04-15Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-15
3. Geändert2026-04-16
4. EPSS aktualisiert2026-04-23

The primary mitigation for CVE-2026-40173 is to immediately upgrade Dgraph Alpha to version 25.3.2 or later, which addresses the exposed debug endpoint. If upgrading is not immediately feasible, consider temporarily disabling the debug endpoint by modifying the Dgraph Alpha configuration and removing the --security "token=..." parameter. While this reduces functionality, it prevents the token from being exposed. Monitor Dgraph Alpha logs for any unusual activity or attempts to access the debug endpoint. After upgrading, confirm the fix by attempting to access the debug endpoint with an unauthenticated request; it should return an error indicating access is denied.