Common Weakness Enumeration
CWE-215
AllowedInsertion of Sensitive Information Into Debugging Code
Abstraction: Base · Status: Draft
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
41 vulnerabilities reference this CWE, most recent first.
CVE-2018-1002104 (GCVE-0-2018-1002104)
Vulnerability from cvelistv5 – Published: 2020-01-14 20:15 – Updated: 2024-09-16 21:07
VLAI
EPSS
VEX
Summary
Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
Severity
5.3 (Medium)
CWE
- CWE-215 - Information Exposure Through Debug Information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/kubernetes/ingress-nginx/pull/3125 | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kubernetes | k8s.gcr.io/defaultbackend |
Affected:
defaultbackend , < 1.5
(custom)
|
Date Public
2018-09-25 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:47:56.919Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/kubernetes/ingress-nginx/pull/3125"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "k8s.gcr.io/defaultbackend",
"vendor": "Kubernetes",
"versions": [
{
"lessThan": "1.5",
"status": "affected",
"version": "defaultbackend",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alexandre Malucelli"
}
],
"datePublic": "2018-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Versions \u003c 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-215",
"description": "CWE-215 Information Exposure Through Debug Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-14T20:15:17.000Z",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubernetes/ingress-nginx/pull/3125"
}
],
"source": {
"defect": [
"https://github.com/kubernetes/ingress-nginx/issues/1733"
],
"discovery": "USER"
},
"workarounds": [
{
"lang": "en",
"value": "Mask the /metrics endpoint with an Ingress rule so that metrics aren\u0027t exposed publicly. See https://github.com/kubernetes/ingress-nginx/issues/1733#issuecomment-358492359"
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@kubernetes.io",
"DATE_PUBLIC": "2018-09-25",
"ID": "CVE-2018-1002104",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "k8s.gcr.io/defaultbackend",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "defaultbackend",
"version_value": "1.5"
}
]
}
}
]
},
"vendor_name": "Kubernetes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Alexandre Malucelli"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Versions \u003c 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-215 Information Exposure Through Debug Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/kubernetes/ingress-nginx/pull/3125",
"refsource": "CONFIRM",
"url": "https://github.com/kubernetes/ingress-nginx/pull/3125"
}
]
},
"source": {
"defect": [
"https://github.com/kubernetes/ingress-nginx/issues/1733"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "en",
"value": "Mask the /metrics endpoint with an Ingress rule so that metrics aren\u0027t exposed publicly. See https://github.com/kubernetes/ingress-nginx/issues/1733#issuecomment-358492359"
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2018-1002104",
"datePublished": "2020-01-14T20:15:17.491Z",
"dateReserved": "2018-12-05T00:00:00.000Z",
"dateUpdated": "2024-09-16T21:07:22.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-1191 (GCVE-0-2018-1191)
Vulnerability from cvelistv5 – Published: 2018-03-29 20:00 – Updated: 2024-09-17 04:10
VLAI
EPSS
VEX
Summary
Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials.
Severity
No CVSS data available.
CWE
- CWE-215 - - Information Exposure Through Debug Information
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cloudfoundry.org/blog/cve-2018-1191/ | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Foundry | Garden-runC |
Affected:
Versions prior to 1.11.0
|
Date Public
2018-03-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T03:51:48.898Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cloudfoundry.org/blog/cve-2018-1191/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Garden-runC",
"vendor": "Cloud Foundry",
"versions": [
{
"status": "affected",
"version": "Versions prior to 1.11.0"
}
]
}
],
"datePublic": "2018-03-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-215",
"description": "CWE-215 - Information Exposure Through Debug Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-29T19:57:01.000Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cloudfoundry.org/blog/cve-2018-1191/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security_alert@emc.com",
"DATE_PUBLIC": "2018-03-28T00:00:00",
"ID": "CVE-2018-1191",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Garden-runC",
"version": {
"version_data": [
{
"version_value": "Versions prior to 1.11.0"
}
]
}
}
]
},
"vendor_name": "Cloud Foundry"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-215 - Information Exposure Through Debug Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cloudfoundry.org/blog/cve-2018-1191/",
"refsource": "CONFIRM",
"url": "https://www.cloudfoundry.org/blog/cve-2018-1191/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2018-1191",
"datePublished": "2018-03-29T20:00:00.000Z",
"dateReserved": "2017-12-06T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:10:09.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-6HW8-32RP-R4VX
Vulnerability from github – Published: 2026-09-14 03:30 – Updated: 2026-09-14 03:30
VLAI
Details
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-33966"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T03:16:36Z",
"severity": "LOW"
},
"details": "An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.",
"id": "GHSA-6hw8-32rp-r4vx",
"modified": "2026-09-14T03:30:22Z",
"published": "2026-09-14T03:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33966"
},
{
"type": "WEB",
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates"
},
{
"type": "WEB",
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/cve-2026-33966"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6V75-2JR8-RWXG
Vulnerability from github – Published: 2025-03-05 06:31 – Updated: 2025-11-03 21:33
VLAI
Details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-27684"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T06:15:41Z",
"severity": "HIGH"
},
"details": "Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.",
"id": "GHSA-6v75-2jr8-rwxg",
"modified": "2025-11-03T21:33:07Z",
"published": "2025-03-05T06:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27684"
},
{
"type": "WEB",
"url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-782W-M9CH-XMP8
Vulnerability from github – Published: 2026-08-24 15:31 – Updated: 2026-08-24 15:31
VLAI
Details
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-21759"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-24T13:17:32Z",
"severity": "MODERATE"
},
"details": "HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.\u00a0 Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.",
"id": "GHSA-782w-m9ch-xmp8",
"modified": "2026-08-24T15:31:51Z",
"published": "2026-08-24T15:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21759"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0131731"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7V28-88F9-8882
Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-23 15:33
VLAI
Details
Insertion of Sensitive Information Into Debugging Code vulnerability in Importify Importify (Dropshipping WooCommerce) allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through 1.0.4.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-49194"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T13:15:35Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information Into Debugging Code vulnerability in Importify Importify (Dropshipping WooCommerce) allows Retrieve Embedded Sensitive Data.This issue affects Importify (Dropshipping WooCommerce): from n/a through 1.0.4.",
"id": "GHSA-7v28-88f9-8882",
"modified": "2026-04-23T15:33:37Z",
"published": "2024-12-09T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49194"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/importify/vulnerability/wordpress-importify-dropshipping-woocommerce-plugin-1-0-4-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7WPP-WF5G-89WP
Vulnerability from github – Published: 2025-07-01 18:30 – Updated: 2025-11-05 00:31
VLAI
Details
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-34081"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-01T18:15:24Z",
"severity": "MODERATE"
},
"details": "The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.",
"id": "GHSA-7wpp-wf5g-89wp",
"modified": "2025-11-05T00:31:18Z",
"published": "2025-07-01T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34081"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU92266386"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/conprosys-hmi-system-exposed-php-debug-info"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-84V7-PQCF-Q646
Vulnerability from github – Published: 2026-09-08 09:35 – Updated: 2026-09-08 09:35
VLAI
Details
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-62652"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T09:18:17Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Reyrolle 7SR5 (All versions \u003c V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device\u0027s firmware, facilitating the identification of further vulnerabilities.",
"id": "GHSA-84v7-pqcf-q646",
"modified": "2026-09-08T09:35:39Z",
"published": "2026-09-08T09:35:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62652"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-142885.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-95MQ-XWJ4-R47P
Vulnerability from github – Published: 2026-04-16 21:08 – Updated: 2026-04-16 21:08
VLAI
Summary
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
Details
Summary
An unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token from --security "token=...".
This does not break token validation logic directly; instead, it discloses the credential and enables unauthorized admin-level access by reusing the leaked token in X-Dgraph-AuthToken.
Details
The behavior occurs entirely within core Alpha HTTP routing and does not require any external proxy, plugin, or non-core integration.
The core issue is not that admin token protection is absent, but that the protected secret is exposed in cleartext through an unauthenticated core debug endpoint.
Relevant code paths:
- dgraph/cmd/alpha/run.go:17 imports net/http/pprof, which registers /debug/pprof/* handlers on the default mux.
- dgraph/cmd/alpha/run.go:533 uses http.Handle("/", audit.AuditRequestHttp(baseMux)), so default-mux handlers remain reachable.
- dgraph/cmd/alpha/admin.go:52 enforces admin token checks in adminAuthHandler for admin endpoints.
- dgraph/cmd/alpha/admin.go:74 shows /admin/config/cache_mb behind adminAuthHandler.
Credential-exposure chain:
1. /debug/pprof/cmdline is reachable without authentication.
2. Its output includes the configured admin token from process arguments.
3. The disclosed token is accepted by adminAuthHandler when sent as X-Dgraph-AuthToken.
4. An attacker gains unauthorized access to admin-only functionality.
Observed local evidence (safe validation):
- Request: GET /admin/config/cache_mb without token
- Status: 200 (request rejected at application layer)
- Body contains error: Invalid X-Dgraph-AuthToken
- The endpoint returns HTTP 200 but indicates authentication failure in the response body.
- Request: GET /debug/pprof/cmdline without token
- Status: 200
- Body excerpt includes: --security=token=TopSecretToken123;
- Request: GET /admin/config/cache_mb with X-Dgraph-AuthToken: TopSecretToken123
- Status: 200
- Body: 4096
Important policy/triage clarification: - This issue persists even when the admin-token security feature is enabled: the token itself is exposed via an unauthenticated core debug endpoint, making this more than a misconfiguration-only concern. - Network restrictions (bind/whitelist/firewall) may reduce exposure, but they do not remediate the underlying credential disclosure behavior.
PoC
- Branch:
main - Commit:
b15c87e93 - Describe:
v25.3.1
Preconditions:
- Alpha HTTP port is reachable by attacker traffic.
- Admin token is configured via supported startup flag: --security "token=...".
- /debug/pprof/* is exposed on the same Alpha HTTP listener.
- This behavior occurs with documented startup flags and without any non-default or unsupported configuration.
Reproduction steps:
1. Start Zero and Alpha (example local setup):
- dgraph zero --my=127.0.0.1:5280 --port_offset=200 --bindall=false --wal=./zw
- dgraph alpha --my=127.0.0.1:7280 --zero=127.0.0.1:5280 --port_offset=200 --bindall=false --security "token=TopSecretToken123;" --postings=./p --wal=./w --tmp=./t
- Verify admin endpoint rejects unauthenticated request:
curl -i http://127.0.0.1:8280/admin/config/cache_mb-
Expected body includes
Invalid X-Dgraph-AuthToken. -
Read token from unauthenticated debug endpoint:
curl -s http://127.0.0.1:8280/debug/pprof/cmdline-
Expected output includes
--security=token=TopSecretToken123;. -
Reuse leaked token against admin endpoint:
curl -i -H "X-Dgraph-AuthToken: TopSecretToken123" http://127.0.0.1:8280/admin/config/cache_mb- Expected: successful response (example observed:
4096).
Note: The PoC uses 127.0.0.1 only for safe local validation. The vulnerable condition is unauthenticated reachability of /debug/pprof/cmdline; in any deployment where Alpha HTTP is reachable by untrusted parties, the same token disclosure and subsequent unauthorized admin access apply.
Impact
- Unauthenticated disclosure of a sensitive admin credential via debug endpoint, enabling unauthorized privileged administrative access through token reuse
- Operators running Dgraph Alpha with admin token configured, where Alpha HTTP/debug routes are reachable by untrusted users or networks.
The attack requires network reachability to the Alpha HTTP port. In deployments where this interface is exposed beyond trusted boundaries, the issue is remotely exploitable without authentication.
Depending on exposed admin functionality in deployment policy, this may allow configuration changes, operational control actions, and other privileged administrative operations exposed through /admin/*.
Severity
9.4 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/dgraph-io/dgraph/v25"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "25.3.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/dgraph-io/dgraph/v24"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "24.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/dgraph-io/dgraph"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40173"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-215",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T21:08:07Z",
"nvd_published_at": "2026-04-15T21:17:27Z",
"severity": "CRITICAL"
},
"details": "### Summary\nAn unauthenticated debug endpoint in Dgraph Alpha exposes the full process command line, including the configured admin token from `--security \"token=...\"`.\n\nThis does not break token validation logic directly; instead, it discloses the credential and enables unauthorized admin-level access by reusing the leaked token in `X-Dgraph-AuthToken`.\n\n### Details\nThe behavior occurs entirely within core Alpha HTTP routing and does not require any external proxy, plugin, or non-core integration.\n\nThe core issue is not that admin token protection is absent, but that the protected secret is exposed in cleartext through an unauthenticated core debug endpoint.\n\nRelevant code paths:\n- `dgraph/cmd/alpha/run.go:17` imports `net/http/pprof`, which registers `/debug/pprof/*` handlers on the default mux.\n- `dgraph/cmd/alpha/run.go:533` uses `http.Handle(\"/\", audit.AuditRequestHttp(baseMux))`, so default-mux handlers remain reachable.\n- `dgraph/cmd/alpha/admin.go:52` enforces admin token checks in `adminAuthHandler` for admin endpoints.\n- `dgraph/cmd/alpha/admin.go:74` shows `/admin/config/cache_mb` behind `adminAuthHandler`.\n\nCredential-exposure chain:\n1. `/debug/pprof/cmdline` is reachable without authentication.\n2. Its output includes the configured admin token from process arguments.\n3. The disclosed token is accepted by `adminAuthHandler` when sent as `X-Dgraph-AuthToken`.\n4. An attacker gains unauthorized access to admin-only functionality.\n\nObserved local evidence (safe validation):\n- Request: `GET /admin/config/cache_mb` without token\n - Status: 200 (request rejected at application layer)\n - Body contains error: `Invalid X-Dgraph-AuthToken`\n - The endpoint returns HTTP 200 but indicates authentication failure in the response body.\n- Request: `GET /debug/pprof/cmdline` without token\n - Status: 200\n - Body excerpt includes: `--security=token=TopSecretToken123;`\n- Request: `GET /admin/config/cache_mb` with `X-Dgraph-AuthToken: TopSecretToken123`\n - Status: 200\n - Body: `4096`\n\nImportant policy/triage clarification:\n- This issue persists even when the admin-token security feature is enabled: the token itself is exposed via an unauthenticated core debug endpoint, making this more than a misconfiguration-only concern.\n- Network restrictions (bind/whitelist/firewall) may reduce exposure, but they do not remediate the underlying credential disclosure behavior.\n\n### PoC\n\n- Branch: `main`\n- Commit: `b15c87e93`\n- Describe: `v25.3.1`\n\nPreconditions:\n- Alpha HTTP port is reachable by attacker traffic.\n- Admin token is configured via supported startup flag: `--security \"token=...\"`.\n- `/debug/pprof/*` is exposed on the same Alpha HTTP listener.\n- This behavior occurs with documented startup flags and without any non-default or unsupported configuration.\n\nReproduction steps:\n1. Start Zero and Alpha (example local setup):\n - `dgraph zero --my=127.0.0.1:5280 --port_offset=200 --bindall=false --wal=./zw`\n - `dgraph alpha --my=127.0.0.1:7280 --zero=127.0.0.1:5280 --port_offset=200 --bindall=false --security \"token=TopSecretToken123;\" --postings=./p --wal=./w --tmp=./t`\n\n2. Verify admin endpoint rejects unauthenticated request:\n - `curl -i http://127.0.0.1:8280/admin/config/cache_mb`\n - Expected body includes `Invalid X-Dgraph-AuthToken`.\n\n3. Read token from unauthenticated debug endpoint:\n - `curl -s http://127.0.0.1:8280/debug/pprof/cmdline`\n - Expected output includes `--security=token=TopSecretToken123;`.\n\n4. Reuse leaked token against admin endpoint:\n - `curl -i -H \"X-Dgraph-AuthToken: TopSecretToken123\" http://127.0.0.1:8280/admin/config/cache_mb`\n - Expected: successful response (example observed: `4096`).\n\nNote: The PoC uses `127.0.0.1` only for safe local validation. The vulnerable condition is unauthenticated reachability of `/debug/pprof/cmdline`; in any deployment where Alpha HTTP is reachable by untrusted parties, the same token disclosure and subsequent unauthorized admin access apply.\n\n### Impact\n\n- Unauthenticated disclosure of a sensitive admin credential via debug endpoint, enabling unauthorized privileged administrative access through token reuse\n- Operators running Dgraph Alpha with admin token configured, where Alpha HTTP/debug routes are reachable by untrusted users or networks.\n\nThe attack requires network reachability to the Alpha HTTP port. In deployments where this interface is exposed beyond trusted boundaries, the issue is remotely exploitable without authentication.\n\nDepending on exposed admin functionality in deployment policy, this may allow configuration changes, operational control actions, and other privileged administrative operations exposed through `/admin/*`.",
"id": "GHSA-95mq-xwj4-r47p",
"modified": "2026-04-16T21:08:07Z",
"published": "2026-04-16T21:08:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40173"
},
{
"type": "PACKAGE",
"url": "https://github.com/dgraph-io/dgraph"
},
{
"type": "WEB",
"url": "https://github.com/dgraph-io/dgraph/releases/tag/v25.3.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints"
}
GHSA-FMXW-GFWM-67W3
Vulnerability from github – Published: 2026-02-11 15:30 – Updated: 2026-02-12 18:30
VLAI
Details
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-2250"
],
"database_specific": {
"cwe_ids": [
"CWE-215"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T15:16:17Z",
"severity": "HIGH"
},
"details": "The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.",
"id": "GHSA-fmxw-gfwm-67w3",
"modified": "2026-02-12T18:30:21Z",
"published": "2026-02-11T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2250"
},
{
"type": "WEB",
"url": "https://cydome.io/vulnerability-advisory-cve-2026-2250-unauthenticated-data-exfilteration-and-information-disclosure-in-metis-wic-wireless-intelligent-collector"
},
{
"type": "WEB",
"url": "https://www.metis.tech"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.
Mitigation MIT-46
Architecture and Design
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
No CAPEC attack patterns related to this CWE.