CVE-2026-111999
7.5HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can inject forged CloudEvents into any eventbus to be stored and processed by subscription sinks. They only need network access to the gateway HTTP receiver.
Root cause
The gateway CloudEvents HTTP receiver fails to enforce token authentication and authPublish checks on the event publishing endpoints.
Affected systems
Vanus 0.8.0 through 0.9.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Upgrade to a fixed release once available, or block external access to the gateway CloudEvents HTTP endpoints (/namespaces/*/eventbus/*/events and /gateway/*) using a reverse proxy or firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.