PT-2026-33176 · Dgraph · Dgraph

Published 2026-04-15 · Updated 2026-04-19 · CVE-2026-40173

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.2

Description An unauthenticated credential disclosure exists where the '/debug/pprof/cmdline' endpoint is registered on the default mux and accessible without authentication. This exposes the full process command line, including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve this token and use it in the X-Dgraph-AuthToken header to bypass the adminAuthHandler() token validation and gain unauthorized privileged administrative access to endpoints such as '/admin/config/cache mb'. This allows for unauthorized configuration changes and operational control actions if the Alpha HTTP port is reachable by untrusted parties.

Recommendations Update to version 25.3.2.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-215

CWE-200

Related Identifiers

CVE-2026-40173

GHSA-95MQ-XWJ4-R47P

Affected Products

Dgraph

References · 11

• 🔥 https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p · Exploit
• https://osv.dev/vulnerability/GHSA-95mq-xwj4-r47p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40173 · Security Note
• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.2 · Note
• https://github.com/dgraph-io/dgraph · Note
• https://twitter.com/pulsepatchio/status/2045334294206284035 · Twitter Post
• https://twitter.com/CCBalert/status/2044784399233790269 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044546283461869632 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044519809153392788 · Twitter Post
• https://twitter.com/CVEnew/status/2044701616885088763 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2045892176068936052 · Twitter Post