Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Summary

Dgraph v25.3.2 still exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints.

This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler.

Details

Alpha still exposes Go's default HTTP mux:

• x/metrics.go
  • imports expvar
  • initializes Conf = expvar.NewMap("dgraph_config")
• Go's expvar package automatically registers /debug/vars
• expvar publishes:
  • cmdline = os.Args
  • memstats = runtime.Memstats

Alpha's HTTP handler explicitly blocks only the old CVE path:

• dgraph/cmd/alpha/run.go
  • checks if r.URL.Path == "/debug/pprof/cmdline" and returns 404
  • otherwise falls through to http.DefaultServeMux.ServeHTTP(w, r)

Admin endpoints still trust the leaked token:

• dgraph/cmd/alpha/admin.go
  • reads X-Dgraph-AuthToken
  • compares it to worker.Config.AuthToken

PoC

1. Send an unauthenticated request to Alpha:

GET /debug/vars HTTP/1.1
Host: target:8080

2. Parse the JSON response and read the cmdline field.

3. Extract the admin token from the startup arguments, for example:

--security token=debug-vars-secret;

4. Replay the token to an admin-only endpoint:

GET /admin/config/cache_mb HTTP/1.1
Host: target:8080
X-Dgraph-AuthToken: debug-vars-secret