CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
Unauthenticated attackers can retrieve admin tokens from the /debug/vars endpoint to bypass authentication and access admin-only features in Dgraph.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41492?
CVE-2026-41492 is a critical vulnerability in dgraph-io dgraph, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.
Weakness: CWE-200
Which versions are affected by CVE-2026-41492?
9 open source packages ship an affected version, including github.com/dgraph-io/dgraph, github.com/dgraph-io/dgraph/v24 and github.com/dgraph-io/dgraph/v25. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgraph-io/dgraph Go | All versions | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph Go | All versions to 1.2.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.8 | None |
github.com/dgraph-io/dgraph/v24 Go | All versions to 24.1.8 | None |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
3 more packages
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
github.com/dgraph-io/dgraph/v25 Go | All versions | 25.3.3 |
github.com/hypermodeinc/dgraph/v24 Go | All versions | 24.1.9 |
Products include Dgraph Dgraph.
How do I fix CVE-2026-41492?
Upgrade to a fixed version.
Is CVE-2026-41492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41492 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in dgraph-io dgraph
- CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
- CVE-2026-40173 Dgraph: Unauthenticated pprof endpoint leaks admin auth token
- CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
- CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
- CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse
Sources
Also known as GHSA-vvf7-6rmr-m29q, GO-2026-5675.