Dgraph, an open source distributed GraphQL database, versions prior to 25.3.2 expose sensitive information through the /debug/pprof/cmdline endpoint, which is accessible without authentication. This endpoint reveals the full process command line, including the admin token configured via the --security "token=..." flag. An attacker can extract this token and reuse it in the X-Dgraph-AuthToken header to bypass admin authentication and access privileged administrative endpoints such as /admin/config/cache_mb. This allows unauthorized configuration changes and operational control on any deployment where the Alpha HTTP port is accessible by untrusted parties. The issue is resolved in version 25.3.2.

The vulnerability allows unauthenticated attackers to obtain the admin token, enabling unauthorized privileged access to administrative endpoints. This can lead to unauthorized configuration changes and operational control over the Dgraph deployment. The impact includes full confidentiality and integrity compromise of the affected system, with limited availability impact. The CVSS 3.1 score of 9.4 reflects critical severity with network attack vector, no privileges required, and no user interaction needed.

Upgrade Dgraph to version 25.3.2 or later, where this vulnerability is fixed. Until the upgrade is applied, restrict access to the Alpha HTTP port to trusted parties only to prevent unauthorized access to the /debug/pprof/cmdline endpoint. Patch status is confirmed fixed in version 25.3.2.