—
GO-2026-5274
Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph
Quick fix
GO-2026-5274 — github.com/dgraph-io/dgraph/v25: upgrade to the fixed version with the command below.
go get github.com/dgraph-io/dgraph/v25@v25.3.2Details
The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/dgraph-io/dgraph
Introduced in:
0 No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
Go / github.com/dgraph-io/dgraph/v25
Introduced in:
0 Fixed in: 25.3.2 Fix
go get github.com/dgraph-io/dgraph/v25@v25.3.2 Go / github.com/hypermodeinc/dgraph/v24
Introduced in:
0 Fixed in: 24.1.9 Fix
go get github.com/hypermodeinc/dgraph/v24@v24.1.9