# Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Unauthenticated /debug/vars on Dgraph Alpha leaks the process cmdline including the --security admin token, which replays via X-Dgraph-AuthToken for admin access.

- Payout: Research
- Severity: critical
- Program: Dgraph
- Found by: MaherAzzouzi
- Disclosed: 2026-04-24
- CVE: CVE-2026-41492
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-vvf7-6rmr-m29q
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-vvf7-6rmr-m29q
- Tags: area:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:go technique:incomplete-fix vuln:auth-bypass vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** Dgraph Alpha HTTP endpoint /debug/vars (Go expvar handler)
**Root cause:** Alpha falls through to http.DefaultServeMux, which serves expvar's /debug/vars exposing os.Args; the prior fix only blocked /debug/pprof/cmdline. Admin token is passed via --security token=... startup flag, so it appears in cmdline.
**Steps:**
1. Send unauthenticated `GET /debug/vars HTTP/1.1` to Alpha on port 8080.
2. Parse JSON response and read the `cmdline` field.
3. Extract token from startup args, e.g. `--security token=debug-vars-secret;`.
4. Replay to admin endpoint: `GET /admin/config/cache_mb` with header `X-Dgraph-AuthToken: debug-vars-secret`.
5. Request accepted as authorized admin; response body `4096`.
**How found:** Noticed the prior CVE fix only special-cased /debug/pprof/cmdline while still delegating to http.DefaultServeMux; traced expvar import in x/metrics.go registering /debug/vars, which publishes cmdline=os.Args, and confirmed the token is commonly passed as a startup flag.
**Exploitation:** Attacker with network reach to Alpha's HTTP port fetches /debug/vars unauthenticated, parses cmdline for the --security token value, then sends it in X-Dgraph-AuthToken to any admin-gated endpoint to read/mutate admin config and perform operational control actions.
**Escalation:** Leaked token grants full admin-gated operations (config read/write, operational control), not just a single endpoint.
**Insight:** When a fix blocks one specific path on a default mux, enumerate every handler the mux still registers (expvar /debug/vars, pprof index) — expvar's cmdline leaks os.Args, so any secret passed as a CLI flag is exposed even if /debug/pprof/cmdline is 404'd.

## Proof of concept (copied exactly from the original report)

**Unauthenticated GET /debug/vars leaking cmdline**

```
GET /debug/vars HTTP/1.1
Host: target:8080
```

**Replay leaked token to admin endpoint**

```
GET /admin/config/cache_mb HTTP/1.1
Host: target:8080
X-Dgraph-AuthToken: debug-vars-secret
```