CVE-2026-40173Disclosure(dgraph / dgraph)

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch dgraph dgraph systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token configured via the --security "token=..." startup flag. An attacker can retrieve the leaked token and reuse it in the X-Dgraph-AuthToken header to gain unauthorized access to admin-only endpoints such as /admin/config/cache_mb, bypassing the adminAuthHandler token validation. This enables unauthorized privileged administrative access including configuration changes and operational control actions in any deployment where the Alpha HTTP port is reachable by untrusted parties. This issue has been fixed in version 25.3.2.

dgraph CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

https://github.com/dgraph-io/dgraph/releases/tag/v25.3.2

Weakness type (CWE)

CWE-200CWE-215CWE-522

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

dgraph

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 4 classified signals
Peaked 3d ago at 2 mentions (2026-04-15); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

dgraph

Products

dgraph

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

Disclosure

466.7%

Patch

233.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-15	2	Disclosure2
2026-04-16	2	Disclosure1Patch1
2026-04-18	1	Disclosure1
2026-04-19	1	Patch1

Full discourse6 posts

Gray Hats@the_yellow_fall172d
Patch
Dgraph (CVE-2026-40173) leaks admin tokens in plain text via unauthenticated debug endpoints. This critical 9.4 CVSS flaw allows full DB takeover. Patch now! #Dgraph #CVE202640173 #DatabaseSecurity #InfoSec #CyberAttack #GraphQL #PatchNow https://securityonline.info/dgraph-admin-token-leak-debug-pprof-cve-2026-40173/ https://t.co/T3OTGklfDY
Post summary
Dgraph CVE‑2026‑40173 leaks admin tokens via unauthenticated debug endpoints, a critical CVSS 9.4 flaw enabling full DB takeover; a patch is available and recommended.
150104895
12.5K followersView on X
PulsePatch.io@pulsepatchio174d
Disclosure
A critical unauthenticated admin token disclosure vulnerability (CVE-2026-40173) impacts `Dgraph`, enabling unauthorized access to admin endpoints. Restrict network access to Alpha nodes. #Dgraph #AuthBypass #InfoSec https://www.pulsepatch.io/posts/cve-2026-40173-dgraph-admin-token-disclosure
Post summary
The text announces a critical admin token disclosure vulnerability in Dgraph, offers a mitigation by restricting network access, and provides minimal technical context without any PoC or exploit details.
0000050
12 followersView on X
CCB Alert@CCBalert175d
Patch
Warning: Critical unauthenticated credential disclosure in #Dgraph #GraphQL CVE-2026-40173 CVSS: 9.4. An attacker can bypass token validation remotely to gain access to sensitive info. Restrict net access to AlphaHTTP to trusted parties only until patching. #Patch #Patch #Patch
Post summary
The tweet informs of a critical credential disclosure vulnerability (CVE‑2026‑40173) affecting Dgraph’s GraphQL API, highlights token validation bypass, and advises restricting network access as a temporary mitigation until a patch is released.
00000143
7.2K followersView on X
CVE@CVEnew175d
Disclosure
CVE-2026-40173 Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof… https://www.cve.org/CVERecord?id=CVE-2026-40173
Post summary
The CVE notes an unauthenticated credential disclosure in Dgraph versions 25.3.1 and earlier via the /debug/pprof endpoint.
00000107
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds176d
Disclosure
CVE-2026-40173 Unauthenticated Credential Disclosure in Dgraph Versions 25.3.1 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40173
Post summary
A concise CVE disclosure describing unauthenticated credential disclosure in Dgraph versions prior to 25.3.1, with no PoC or exploit information included.
0000040
4.0K followersView on X
0day Signal@0dayPublishing176d
Disclosure
🚨 CVE-2026-40173: Dgraph: Unauthenticated pprof en... Go's pprof debug endpoint accidentally becomes a credential vending machine - cmdline exposure turns admin tokens into ... https://zerodaysignal.com/vulnerability/CVE-2026-40173 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2026‑40173, noting that an unauthenticated Go pprof debug endpoint can expose admin tokens via command‑line exposure, effectively turning it into a credential vending machine.
0000081
218 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dgraph	dgraph	-	go	-

Explore more

Back to dashboard dgraph CVEs dgraph vulnerabilities

What researchers are saying

CVE-2026-40173

Gray Hats@the_yellow_fallPatch

Dgraph CVE‑2026‑40173 leaks admin tokens via unauthenticated debug endpoints, a critical CVSS 9.4 flaw enabling full DB takeover; a patch is available and recommended.

PulsePatch.io@pulsepatchioDisclosure

The text announces a critical admin token disclosure vulnerability in Dgraph, offers a mitigation by restricting network access, and provides minimal technical context without any PoC or exploit details.

CCB Alert@CCBalertPatch

The tweet informs of a critical credential disclosure vulnerability (CVE‑2026‑40173) affecting Dgraph’s GraphQL API, highlights token validation bypass, and advises restricting network access as a temporary mitigation until a patch is released.

CVE@CVEnewDisclosure

The CVE notes an unauthenticated credential disclosure in Dgraph versions 25.3.1 and earlier via the /debug/pprof endpoint.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A concise CVE disclosure describing unauthenticated credential disclosure in Dgraph versions prior to 25.3.1, with no PoC or exploit information included.

0day Signal@0dayPublishingDisclosure

The post announces CVE‑2026‑40173, noting that an unauthenticated Go pprof debug endpoint can expose admin tokens via command‑line exposure, effectively turning it into a credential vending machine.