Dgraph exposes the full process command line through the /debug/pprof/cmdline endpoint without requiring authentication. The command line contains the admin token defined by the --security "token=..." flag, which attackers can capture and embed in the X-Dgraph-AuthToken header to bypass the adminAuthHandler. This allows read/write access to admin‑only routes, including configuration changes and operational controls, effectively granting full administrative privileges for any deployment with an exposed Alpha HTTP port.

Vulnerable products are the dgraph-io dgraph 25.3.1 and earlier releases. The issue exists when the Alpha HTTP port is reachable by untrusted network participants. Any deployment of these versions in an unprotected environment is susceptible.

The vulnerability has a CVSS base score of 9.4, indicating critical severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, but the absence of authentication and the ubiquity of the exposed endpoint make exploitation straightforward for anyone with network access to the target service. The attack vector is a simple unauthenticated HTTP request to the pprof endpoint, enabling credential disclosure and subsequent privilege escalation.