[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-41492":6},{"stargazers_count":4,"fetched_at":5},5,"2026-04-25T12:20:59.409Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":256,"aliases":257,"duplicate_of":9,"upstream":258,"downstream":259,"duplicates":260,"related":261,"reserved_at":9,"published_at":262,"modified_at":263,"state":264,"summary":265,"references_raw":272,"kevs":284,"epss":9,"epss_history":285,"metrics":286,"affected":293},"CVE-2026-41492","Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security \"token=...\" startup flag, an unauthenticated attacker can retrieve that token and replay it in the X-Dgraph-AuthToken header to access admin-only endpoints. This is a variant of the previously fixed /debug/pprof/cmdline issue, but the current fix is incomplete because it blocks only /debug/pprof/cmdline and still serves http.DefaultServeMux, which includes expvar's /debug/vars handler. This vulnerability is fixed in 25.3.3.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-200","Exposure of Sensitive Information to an Unauthorized Actor","The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","weakness","Draft","Class","High",[20,24,28,32,36,40,44,48,52,56,60,64,68,72,76,80,84,88,92,96,100,104,108,112,116,120,124,128,132,136,140,144,148,152,156,160,164,168,172,176,180,184,188,192,196,200,204,208,212,216,220,224,228,232,236,240,244,248,252],{"id":21,"name":22,"techniques":23},"CAPEC-116","Excavation",[],{"id":25,"name":26,"techniques":27},"CAPEC-13","Subverting Environment Variable Values",[],{"id":29,"name":30,"techniques":31},"CAPEC-169","Footprinting",[],{"id":33,"name":34,"techniques":35},"CAPEC-22","Exploiting Trust in Client",[],{"id":37,"name":38,"techniques":39},"CAPEC-224","Fingerprinting",[],{"id":41,"name":42,"techniques":43},"CAPEC-285","ICMP Echo Request Ping",[],{"id":45,"name":46,"techniques":47},"CAPEC-287","TCP SYN Scan",[],{"id":49,"name":50,"techniques":51},"CAPEC-290","Enumerate Mail Exchange (MX) Records",[],{"id":53,"name":54,"techniques":55},"CAPEC-291","DNS Zone Transfers",[],{"id":57,"name":58,"techniques":59},"CAPEC-292","Host Discovery",[],{"id":61,"name":62,"techniques":63},"CAPEC-293","Traceroute Route Enumeration",[],{"id":65,"name":66,"techniques":67},"CAPEC-294","ICMP Address Mask Request",[],{"id":69,"name":70,"techniques":71},"CAPEC-295","Timestamp Request",[],{"id":73,"name":74,"techniques":75},"CAPEC-296","ICMP Information Request",[],{"id":77,"name":78,"techniques":79},"CAPEC-297","TCP ACK Ping",[],{"id":81,"name":82,"techniques":83},"CAPEC-298","UDP Ping",[],{"id":85,"name":86,"techniques":87},"CAPEC-299","TCP SYN Ping",[],{"id":89,"name":90,"techniques":91},"CAPEC-300","Port Scanning",[],{"id":93,"name":94,"techniques":95},"CAPEC-301","TCP Connect Scan",[],{"id":97,"name":98,"techniques":99},"CAPEC-302","TCP FIN Scan",[],{"id":101,"name":102,"techniques":103},"CAPEC-303","TCP Xmas Scan",[],{"id":105,"name":106,"techniques":107},"CAPEC-304","TCP Null Scan",[],{"id":109,"name":110,"techniques":111},"CAPEC-305","TCP ACK Scan",[],{"id":113,"name":114,"techniques":115},"CAPEC-306","TCP Window Scan",[],{"id":117,"name":118,"techniques":119},"CAPEC-307","TCP RPC Scan",[],{"id":121,"name":122,"techniques":123},"CAPEC-308","UDP Scan",[],{"id":125,"name":126,"techniques":127},"CAPEC-309","Network Topology Mapping",[],{"id":129,"name":130,"techniques":131},"CAPEC-310","Scanning for Vulnerable Software",[],{"id":133,"name":134,"techniques":135},"CAPEC-312","Active OS Fingerprinting",[],{"id":137,"name":138,"techniques":139},"CAPEC-313","Passive OS Fingerprinting",[],{"id":141,"name":142,"techniques":143},"CAPEC-317","IP ID Sequencing Probe",[],{"id":145,"name":146,"techniques":147},"CAPEC-318","IP 'ID' Echoed Byte-Order Probe",[],{"id":149,"name":150,"techniques":151},"CAPEC-319","IP (DF) 'Don't Fragment Bit' Echoing Probe",[],{"id":153,"name":154,"techniques":155},"CAPEC-320","TCP Timestamp Probe",[],{"id":157,"name":158,"techniques":159},"CAPEC-321","TCP Sequence Number Probe",[],{"id":161,"name":162,"techniques":163},"CAPEC-322","TCP (ISN) Greatest Common Divisor Probe",[],{"id":165,"name":166,"techniques":167},"CAPEC-323","TCP (ISN) Counter Rate Probe",[],{"id":169,"name":170,"techniques":171},"CAPEC-324","TCP (ISN) Sequence Predictability Probe",[],{"id":173,"name":174,"techniques":175},"CAPEC-325","TCP Congestion Control Flag (ECN) Probe",[],{"id":177,"name":178,"techniques":179},"CAPEC-326","TCP Initial Window Size Probe",[],{"id":181,"name":182,"techniques":183},"CAPEC-327","TCP Options Probe",[],{"id":185,"name":186,"techniques":187},"CAPEC-328","TCP 'RST' Flag Checksum Probe",[],{"id":189,"name":190,"techniques":191},"CAPEC-329","ICMP Error Message Quoting Probe",[],{"id":193,"name":194,"techniques":195},"CAPEC-330","ICMP Error Message Echoing Integrity Probe",[],{"id":197,"name":198,"techniques":199},"CAPEC-472","Browser Fingerprinting",[],{"id":201,"name":202,"techniques":203},"CAPEC-497","File Discovery",[],{"id":205,"name":206,"techniques":207},"CAPEC-508","Shoulder Surfing",[],{"id":209,"name":210,"techniques":211},"CAPEC-573","Process Footprinting",[],{"id":213,"name":214,"techniques":215},"CAPEC-574","Services Footprinting",[],{"id":217,"name":218,"techniques":219},"CAPEC-575","Account Footprinting",[],{"id":221,"name":222,"techniques":223},"CAPEC-576","Group Permission Footprinting",[],{"id":225,"name":226,"techniques":227},"CAPEC-577","Owner Footprinting",[],{"id":229,"name":230,"techniques":231},"CAPEC-59","Session Credential Falsification through Prediction",[],{"id":233,"name":234,"techniques":235},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[],{"id":237,"name":238,"techniques":239},"CAPEC-616","Establish Rogue Location",[],{"id":241,"name":242,"techniques":243},"CAPEC-643","Identify Shared Files/Directories on System",[],{"id":245,"name":246,"techniques":247},"CAPEC-646","Peripheral Footprinting",[],{"id":249,"name":250,"techniques":251},"CAPEC-651","Eavesdropping",[],{"id":253,"name":254,"techniques":255},"CAPEC-79","Using Slashes in Alternate Encoding",[],[],[],[],[],[],[],"2026-04-24T18:29:40.555Z","2026-04-24T19:13:03.267Z","Received",{"cisa_kev":266,"cisa_ransomware":266,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":267,"severity_score":268,"severity_version":269,"severity_source":270,"severity_vector":271,"severity_status":264},false,"critical",9.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",[273,279],{"url":274,"sources":275,"tags":277},"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-vvf7-6rmr-m29q",[270,276],"nvd",[278],"X Refsource CONFIRM",{"url":280,"sources":281,"tags":282},"https://github.com/dgraph-io/dgraph/releases/tag/v25.3.3",[270,276],[283],"X Refsource MISC",[],[],[287,291],{"source":270,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":288,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":289,"vectorString":271,"impactScore":268,"exploitabilityScore":290},"CRITICAL",10,{"source":276,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":292,"cvss_v4_0":9},{"baseScore":268,"baseSeverity":289,"vectorString":271,"impactScore":268,"exploitabilityScore":290},[294],{"ecosystem":9,"name":295,"vendor":296,"product":295,"cpe_part":297,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":298},"dgraph","dgraph-io","a",[299],{"version":300,"is_range":301,"range_type":270,"version_start":9,"version_start_type":9,"version_end":302,"version_end_type":303,"fixed_in":9},"\u003C 25.3.3",true,"25.3.3","excluding"]