EUVD-2026-66608
GHSA-c937-9ccf-7mq9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach daemon web-service port
-
DeliverySend unauthenticated GET to gflags read route
-
ExploitHarvest cert, key, password-file paths
-
ExecutionPOST flag map to write route
-
PersistDisable transport-security flags, redirect logs
-
ImpactWeaken auth lockout and persist access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the daemon's built-in web-service port, which by default binds to all interfaces (0.0.0.0) with no authentication, token check, or address restriction - no credentials, user interaction, or non-default configuration is needed against a default NebulaGraph 3.8.0 or earlier deployment. The concrete prerequisite is that the gflags read/write routes in WebService.cpp are reachable from the attacker's position; the enable_authorize refusal reported elsewhere is absent at 3.8.0, so even that single guard does not apply. The primary limiting factor is network segmentation: if the web-service port is bound to loopback or firewalled to trusted management hosts, the attack surface is removed. Impact is also bounded to the daemon's own configuration (scope unchanged), not directly to other systems. |
| Impact | This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk artifact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns with the description: fully remote, no privileges, no user interaction, and high confidentiality and integrity impact, with availability impact plausible through log redirection and flag tampering. No EPSS score, KEV listing, or POC flag was supplied, so exploitation-probability and active-exploitation signals are unknown rather than reassuring - and given how trivially the endpoint is reached, the absence of an EPSS value should not be read as low risk. The main mitigating factor is exposure: risk is concentrated where the web-service port is reachable from untrusted networks, so a deployment that firewalls the management port off is far less exposed than one left on 0.0.0.0. Any operator running NebulaGraph 3.8.0 or earlier with the web service reachable should treat this as urgent and verify network exposure immediately. |
| Exploit ScenarioDerived | An attacker who can reach a NebulaGraph daemon's web-service port sends an unauthenticated GET to the gflags read route and receives the full runtime configuration, including certificate, key, CA, and password-file paths and data directories. They then POST a flag map to the write route to disable the transport-security enable flags and redirect log files, downgrading the daemon's security in real time without a restart. No public exploit is identified, but the interaction is a simple pair of HTTP requests requiring no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version 3.8.0 lets any network-reachable attacker read and rewrite daemon gflags via the built-in web service. Because the service in src/webservice/WebService.cpp binds to all interfaces with no authentication, token, or address restriction, an attacker can harvest sensitive paths (certificate, key, CA, and password-file locations) and disable transport-security flags, redirect logging, and weaken lockout controls without a restart. No public exploit is identified at time of analysis, but the flaw is trivial to trigger and was reported by VulnCheck.
RemediationAI
No vendor-released patch version is identified in the supplied data, so remediation centers on compensating controls. Primary control: restrict the web-service bind address away from 0.0.0.0 to a loopback or management-only interface, and firewall the daemon web-service ports so they are reachable only from trusted administrative hosts - this directly removes the unauthenticated network path with minimal functional side effect beyond needing local/VPN access for status and gflags operations. Additionally place a reverse proxy enforcing authentication in front of any web endpoint that must remain reachable, and monitor for unexpected runtime changes to transport-security flags, log paths, failed_login_attempts, and password_lock_time_in_secs. Because the write route can disable transport security live, alert on any gflags modification. Track vendor guidance via issue https://github.com/vesoft-inc/nebula/issues/6157 and the VulnCheck advisory at https://www.vulncheck.com/advisories/nebulagraph-through-3.8.0-unauthenticated-read-and-modification-of-runtime-configuration, and upgrade to a fixed release once the vendor publishes one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NebulaGraph is a distributed graph database whose daemons (graphd, metad, storaged) each launch an HTTP web service for status, statistics, and gflags management. gflags is Google's command-line/runtime flag library; NebulaGraph exposes a read route that dumps every runtime flag value and a write route (SetFlagsHandler.cpp) that parses a caller-supplied map and applies each entry through the gflags runtime setter, changing behaviour live. The root cause is CWE-306 (Missing Authentication for a Critical Function): a security-relevant management interface is served with no authentication, no token check, and a default bind address of all interfaces (0.0.0.0). The CPE cpe:2.3:a:vesoft-inc:nebula:*:*:*:*:*:*:*:* covers the affected product, and public reports note that a guard refusing the single flag enable_authorize is absent at release 3.8.0, so the handler applies every flag name it receives.
Know when Nebula gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, no interaction against a default-all-interfaces service; PR:N and AC:L are justified, and config disclosure plus live flag rewrite give high C/I/A.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
Executive ViewAI
NebulaGraph database instances (versions ≤3.8.0) are vulnerable to unauthenticated configuration tampering through an exposed management interface, enabling attackers to harvest stored credentials and disable encryption controls without authorization. This vulnerability bypasses both authentication and network boundaries, creating immediate risk of data exfiltration and security control bypass for any organization running affected versions in networked environments. No public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Deploy the following controls: (1) Firewall-based network isolation restricting web service access to internal trusted networks only; (2) Reverse proxy or Web Application Firewall (WAF) layer requiring authentication; (3) Complete disablement of the built-in web service if not operationally required; (4) Real-time alerting and logging of configuration access attempts; (5) Immediate rotation of any database credentials, certificates, and keys that may be exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticate
Nebula is a scalable overlay networking tool. [CVSS 8.1 HIGH]
Exploit-DB