Dgraph, an open‑source distributed GraphQL database, exposes the process command line through its unauthenticated /debug/vars endpoint on the Alpha API. The admin token is normally supplied via the --security "token=..." startup flag, so an attacker who reads /debug/vars can recover this token and reuse it in the X-Dgraph-AuthToken header to access privileged admin‑only endpoints. The flaw stems from an incomplete mitigation of a prior /debug/pprof/cmdline disclosure; the fix only blocked that handler and left the default HTTP multiplexer, which still serves the expvar /debug/vars endpoint. The vulnerability is a classic information‑leak (CWE-200) that can be turned into a full authentication bypass.

The issue affects installations of dgraph-io:dgraph versions prior to 25.3.3. Any deployment that has the /debug/vars path enabled and that supplies an admin token via the --security flag is vulnerable. The affected component is the Alpha API server, which serves the expvar metrics endpoint without authorization.

The CVSS score of 9.8 marks this as critical. The EPSS score of less than 1% indicates exploitation probability is currently very low, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. Nevertheless, an attacker who can reach the /debug/vars endpoint—such as through an exposed localhost interface or misconfigured network—can retrieve the admin token in one request, then replay it to any admin endpoint. The attack requires no authentication and can be performed entirely via HTTP GET, making it trivial in the correct environment.