CVE-2026-40173

The /debug/pprof/cmdline endpoint is registered on the default HTTP mux and is accessible without any authentication. It contains the full command line of the process, including the administrative token passed via the --security "token=..." startup flag. An attacker reads this token and passes it in the X-Dgraph-AuthToken header, thereby bypassing the verification performed by adminAuthHandler. This grants access to protected administrative endpoints, such as /admin/config/cache_mb, enabling configuration changes and administrative operations.

An attacker with network access to the Alpha HTTP port can obtain full, unauthorized administrative privileges, including the ability to modify configuration and perform management operations on the database.

Dgraph should be updated to version 25.3.2, where the issue has been fixed. Until the update is applied, it is recommended to restrict network access to the Alpha HTTP port only to trusted hosts (e.g., through firewall or network rules) to minimize the risk of exposure.

Dgraph in versions 25.3.1 and earlier, in all deployments where the Alpha HTTP port is accessible to untrusted parties.