EUVD-2026-59772
GHSA-wmqf-q66j-3h4j
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no privileges required, but high complexity from need for prior username knowledge; only partial confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended.
AnalysisAI
VMAuth, the authentication proxy component of VictoriaMetrics through version 1.146.0, fails to restrict the rate of authentication attempts in its requestHandler function, enabling remote brute-force attacks against credentials protecting proxied metrics backends. The missing delay or lockout mechanism allows an attacker to enumerate credential combinations at network speed with no server-side throttling. Publicly available exploit code exists (CVSS 4.0 E:P supplemental), though this CVE does not appear in the CISA KEV catalog and real-world exploitation risk is tempered by the high attack complexity rating.
Technical ContextAI
VMAuth is VictoriaMetrics' HTTP authentication proxy and reverse proxy, configured via YAML to enforce Basic Auth, Bearer tokens, or other schemes in front of time-series metrics backends. The vulnerable code path is the requestHandler function in app/vmauth/main.go, which processed all proxied requests and returned 401 Unauthorized responses with no artificial delay. CWE-307 (Improper Restriction of Excessive Authentication Attempts) captures the root cause: the absence of any rate-limiting, lockout, or response-delay mechanism on failed authentication, enabling high-speed credential enumeration. The fix introduced in commit 119ba0fb5be8024d50c5ba946599b2e69e8803ea adds a slowdownUnauthorizedResponse() function that imposes a random 2-3 second delay (using math/rand/v2 and a timer pool) before returning any unauthorized response, consistent with OWASP A07:2025 Authentication Failures guidance. No CPE strings were provided in the input data.
RemediationAI
Upgrade VictoriaMetrics to version 1.147.0 or later, available at https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.147.0. This release includes commit 119ba0fb5be8024d50c5ba946599b2e69e8803ea, which introduces a 2-3 second randomized response delay on all unauthorized authentication attempts. If immediate upgrade is not feasible, apply compensating controls in order of effectiveness: restrict VMAuth's network exposure to internal or VPN-accessible interfaces only, eliminating external attack surface with no functional impact for internal deployments; configure a WAF or upstream reverse proxy (e.g., nginx limit_req_zone) to enforce per-IP rate limiting on failed authentication responses, noting that aggressive rate limits may interfere with legitimate rapid-reconnect clients; and enforce strong, randomly generated credentials for all VMAuth-protected backends to make brute-force computationally impractical even without server-side throttling. Refer to the GitHub Security Advisory at https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-c7pm-322g-r9gf for vendor guidance.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today