Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-81032: NebulaGraph lets anyone read and change its settings

CVE-2026-81032 · published 8 days ago

Summary

NebulaGraph runs a web service that shows all of its current configuration and lets anyone change those settings without needing a password. This means an attacker could view sensitive paths, turn off security features, or alter how the system behaves. To protect your system, block or restrict access to this web service, apply firewall rules, and update to a version that disables the unauthenticated configuration endpoint.

Original advisory text

NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81032... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-81032 Vendor Advisory
https://www.vulncheck.com/advisories/nebulagraph-through-3.8.0-unauthenticated-r... Vendor Advisory
https://github.com/vesoft-inc/nebula/issues/6157 Third Party Advisory
https://github.com/vesoft-inc/nebula Product
https://github.com/vesoft-inc/nebula/blob/v3.8.0/src/webservice/SetFlagsHandler.... Third Party Advisory
https://github.com/vesoft-inc/nebula/blob/v3.8.0/src/webservice/WebService.cpp Third Party Advisory

Severity

9.9 Critical

CVSS 4.0: 9.9 (OSV)

Exploitation

EPSS <1%

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published26 Aug 2026

Updated2 Sep 2026

First seen29 Aug 2026

Sources

CVE-2026-81032 · OSV

CVE-2026-81032 · NVD

Monitor software like this

Free during beta