CVE-2026-41492

critical
Published 2026-04-24 · Modified 2026-05-04
CVSS v3
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
VIR risk
9.8

Description

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Predictions

Exploit likelihood
97%
Patch ETA

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3

Package impact

EcosystemPackageVulnerableFixed
golang Gogithub.com/dgraph-io/dgraph/v25<25.3.325.3.3
golang Gogithub.com/dgraph-io/dgraph/v24<=24.1.8
golang Gogithub.com/dgraph-io/dgraph<=1.2.8
golang GOgithub.com/dgraph-io/dgraph<= 1.2.8
golang GOgithub.com/dgraph-io/dgraph/v24<= 24.1.8
golang GOgithub.com/dgraph-io/dgraph/v25< 25.3.325.3.3

Application impact

VendorProductVersionsFixed
dgraphdgraph{"endExcluding":"25.3.3"}25.3.3

References

CWEs

CWE-200

Verify integrity in audit chain (admin only). AS-IS.