—
GO-2026-5675
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
Quick fix
GO-2026-5675 — github.com/dgraph-io/dgraph/v25: upgrade to the fixed version with the command below.
go get github.com/dgraph-io/dgraph/v25@v25.3.3Details
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/dgraph-io/dgraph
Introduced in:
0 No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
Go / github.com/dgraph-io/dgraph/v25
Introduced in:
0 Fixed in: 25.3.3 Fix
go get github.com/dgraph-io/dgraph/v25@v25.3.3 Go / github.com/hypermodeinc/dgraph/v24
Introduced in:
0 Fixed in: 24.1.9 Fix
go get github.com/hypermodeinc/dgraph/v24@v24.1.9