Description
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
Published: 2026-08-26
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated read and modification of NebulaGraph runtime configuration
Action: Immediate Patch
AI Analysis

Impact

NebulaGraph exposes a web service that lets any network host read and write its runtime flags without authentication, a direct violation of CWE-306, Authentication Bypass Through User-Controlled Credentials. An attacker reaching the HTTP port can retrieve sensitive configuration paths, certificates, passwords, and data directories, and can alter settings that control transport security, logging, and login policies. This ability to change daemon behavior in real time leads to loss of confidentiality, integrity, and availability of the graph database system.

Affected Systems

All NebulaGraph releases up to version 3.8.0 are affected. The vulnerability resides in the web service initialized by src/webservice/WebService.cpp, which binds by default to all network interfaces and registers flag read/write handlers used by every daemon process.

Risk and Exploitability

With a CVSS score of 9.3 the flaw is rated critical, and although the EPSS score is not published, the absence of authentication makes exploitation highly probable for any host that can reach the exposed port. The flaw is currently not listed in CISA's KEV catalog. The likely attack vector is a network attacker who can connect to the web service, enabling immediate read and write operations without restarting the service or changing any other configuration.

Generated by OpenCVE AI on August 26, 2026 at 18:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch that removes unauthenticated access to the flag endpoints or implements proper authentication to mitigate the CWE-306 weakness.
  • Reconfigure the NebulaGraph web service to bind only to localhost or a secure internal interface; if the service is not required, disable it altogether to eliminate the exposed endpoint.
  • Block inbound traffic to the web service port from untrusted networks with firewall rules, ensuring that only privileged hosts can reach the configuration endpoints.

Generated by OpenCVE AI on August 26, 2026 at 18:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Vesoft
Vesoft nebula
Vendors & Products Vesoft
Vesoft nebula

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
Title NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Vesoft Nebula
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-26T17:10:45.206Z

Reserved: 2026-08-26T15:23:06.686Z

Link: CVE-2026-81032

cve-icon Vulnrichment

Updated: 2026-08-26T17:10:30.971Z

cve-icon NVD

Status : Received

Published: 2026-08-26T16:16:46.013

Modified: 2026-08-26T18:17:05.890

Link: CVE-2026-81032

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:32:45Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function