Vanus EUVD-2026-103452

Exploitation requires that the Vanus gateway's CloudEvents HTTP receiver be network-reachable by the attacker; any such endpoint on versions 0.8.0 through 0.9.0 is affected because the flaw is in the default request-handling path. The attacker sends forged CloudEvents to /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path, and no valid token, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). Limiting factors: the gateway must be exposed to the attacker (deployments restricted to a trusted internal network sharply reduce reachability), and impact is confined to event-stream integrity - attackers cannot read existing data or take the service down through this flaw alone. Downstream consequences depend on how trusting the configured subscription sinks are of injected events.

Signals are moderately consistent and point to a real but bounded integrity risk rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, unauthenticated, network-facing flaw, which aligns cleanly with the CWE-306 missing-authentication classification and the description's claim that token authentication and authPublish checks are bypassed. Critically, impact is scoped to integrity only (VI:H, with VC:N and VA:N) - attackers can inject/forge events but cannot directly read data or crash the service, so the 8.7 score is driven entirely by the ease of event forgery, not by data disclosure or denial of service. No EPSS score, CISA KEV listing, or published proof-of-concept was provided in the intelligence, so exploitation-probability data is MISSING; the absence of KEV/EPSS should not be read as low risk, only as unmeasured. The references include a GitHub issue (#647) and the exact vulnerable source location (gateway.go#L81-L124), which lowers the bar for a skilled attacker to reproduce the issue even though no weaponized exploit is cited. Net: this is a genuine priority for any internet-exposed Vanus 0.8.0-0.9.0 gateway, but its real-world blast radius is limited by Vanus's niche deployment footprint and the integrity-only impact.

An attacker locates an internet-reachable Vanus gateway and sends a crafted CloudEvents HTTP POST to /namespaces/{ns}/eventbus/{name}/events (or the legacy /gateway/{name} path) with no valid token. Because authentication and authPublish checks are bypassed, the forged event is accepted, stored, and delivered to downstream subscription sinks, allowing the attacker to poison event streams or trigger unintended actions in consuming services. No public exploit was identified at time of analysis, but the vulnerable code path is publicly documented and the attack requires only low-complexity unauthenticated HTTP requests.