GO-2026-5274

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5274

Import Source

https://vuln.go.dev/ID/GO-2026-5274.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5274

Aliases

Published

2026-08-11T20:19:48Z

Modified

2026-08-11T20:33:01.945728099Z

Summary

Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph

Details

The /debug/pprof/cmdline endpoint in Dgraph Alpha discloses the command-line arguments used to start the process, which may include the administrator's authentication token if provided via the --auth_token flag. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5274"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5274.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.3.2

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5274.json"

Go / github.com/hypermodeinc/dgraph/v24

Package

Name: github.com/hypermodeinc/dgraph/v24; View open source insights on deps.dev
Purl: pkg:golang/github.com/hypermodeinc/dgraph/v24

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

24.1.9

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hypermodeinc/dgraph/v24"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5274.json"