Threats tagged 'ghsa-vvf7-6rmr-m29q'

Dgraph version 25.3.2 and earlier expose the process command line, including the admin token, via the unauthenticated /debug/vars endpoint on the Alpha service. This allows an unauthenticated attacker to retrieve the admin token supplied at startup and use it to bypass authentication by replaying it in the X-Dgraph-AuthToken header. The vulnerability is a variant of a previously fixed issue but remains due to incomplete mitigation. The flaw enables unauthorized administrative access to privileged endpoints.