CVE-2026-41492 - Vulnerability Analysis

Overview

Dgraph < 25.3.3 contains an information disclosure caused by unauthenticated access to /debug/vars endpoint exposing process command line, letting unauthenticated attackers retrieve admin tokens and access admin-only endpoints, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can retrieve admin tokens and access admin-only endpoints, leading to full administrative control.

Mitigation

Update to version 25.3.3 or later.

References

• https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3
• https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner