Dgraph’s Debug Endpoint Hands Over Admin Tokens to Anyone

A critical Dgraph vulnerability (CVE-2026-40173, CVSS 9.4) was disclosed: the default inclusion of net/http/pprof exposes /debug/pprof/cmdline without authentication, revealing the admin token in plaintext. An attacker with network access to the Alpha HTTP port can read the token and perform admin-level actions by supplying it in X-Dgraph-AuthToken; all versions up to v25.3.1 are affected and a fix was released in v25.3.2.