GO-2026-5675

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5675"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5675.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

25.3.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5675.json"

Go / github.com/hypermodeinc/dgraph/v24

Package

Name: github.com/hypermodeinc/dgraph/v24; View open source insights on deps.dev
Purl: pkg:golang/github.com/hypermodeinc/dgraph/v24

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

24.1.9

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hypermodeinc/dgraph/v24"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5675.json"