CVE-2026-40173: RCE in Dgraph Alpha via Debug Endpoint

The primary impact of CVE-2026-40173 is the unauthorized disclosure of the Dgraph Alpha admin token. While the token validation logic itself remains intact, the exposure of this credential bypasses authentication entirely. An attacker can simply reuse the leaked token in the X-Dgraph-AuthToken header to gain full administrative privileges. This grants them the ability to read, write, and delete data, modify the Dgraph configuration, and potentially compromise the entire system. The lack of authentication required for accessing the debug endpoint significantly broadens the attack surface, making exploitation trivial. This vulnerability is similar in impact to credential leakage vulnerabilities found in other database systems, where exposed credentials can lead to complete system takeover.

1. Reserved2026-04-09
2. Published2026-04-15
3. Modified2026-04-16
4. EPSS updated2026-04-23

The primary mitigation for CVE-2026-40173 is to immediately upgrade Dgraph Alpha to version 25.3.2 or later, which addresses the exposed debug endpoint. If upgrading is not immediately feasible, consider temporarily disabling the debug endpoint by modifying the Dgraph Alpha configuration and removing the --security "token=..." parameter. While this reduces functionality, it prevents the token from being exposed. Monitor Dgraph Alpha logs for any unusual activity or attempts to access the debug endpoint. After upgrading, confirm the fix by attempting to access the debug endpoint with an unauthenticated request; it should return an error indicating access is denied.