Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Vanus lets unauthenticated users post events

CVE-2026-111999 · published 17 days ago
Summary

Versions 0.8.0 through 0.9.0 of Vanus do not verify the identity of callers who send events through its CloudEvents HTTP gateway. This means anyone on the network can publish messages to any event bus, which will then be delivered to your downstream systems. Update to a newer version or apply the vendor’s patch to enforce authentication for event publishing.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
vanus-labs vanus <= 0.9.0
Original advisory text
Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published18 Oct 2026
Updated4 Nov 2026
First seen18 Oct 2026
Sources
CVE-2026-111999 · NVD
CVE-2026-111999 · MITRE
CVE-2026-111999 · OSV
Track software like this
Free during beta