CVE-2026-40173 Dgraph: Unauthenticated pprof endpoint leaks admin auth token
Unauthenticated access to the pprof endpoint leaks the admin token, allowing attackers to gain unauthorized administrative control over the Dgraph database.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40173?
CVE-2026-40173 is a critical vulnerability in dgraph-io dgraph, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve the leaked token and reuse it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints such as /admin/config/cache_mb, bypassing the adminAuthHandler token validation. This enables unauthorized privileged administrative access including configuration changes and operational control actions in any deployment where the Alpha HTTP port is reachable by untrusted parties. This issue has been fixed in version 25.3.2.
Which versions are affected by CVE-2026-40173?
9 open source packages ship an affected version, including github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 and github.com/dgraph-io/dgraph/v25. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph Go | All versions | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.7 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.7 | None |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.2 |
3 more packages
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.2 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.2 |
github.com/hypermodeinc/dgraph/v24 Go | All versions | 24.1.9 |
Products include Dgraph Dgraph.
How do I fix CVE-2026-40173?
Upgrade to a fixed version.
Is CVE-2026-40173 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40173 exists.
Other vulnerabilities in dgraph-io dgraph
- CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
- CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
- CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
- CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse
Sources
Also known as GHSA-95mq-xwj4-r47p, GO-2026-5274.