Nebula
Monthly
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version 3.8.0 lets any network-reachable attacker read and rewrite daemon gflags via the built-in web service. Because the service in src/webservice/WebService.cpp binds to all interfaces with no authentication, token, or address restriction, an attacker can harvest sensitive paths (certificate, key, CA, and password-file locations) and disable transport-security flags, redirect logging, and weaken lockout controls without a restart. No public exploit is identified at time of analysis, but the flaw is trivial to trigger and was reported by VulnCheck.
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. Fabricated points derived from adjacent heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, creating a sensor-integrity risk with direct safety implications; no public exploit code and no CISA KEV listing are identified at time of analysis.
Nebula is a scalable overlay networking tool. [CVSS 8.1 HIGH]
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthenticated disclosure and modification of runtime configuration in NebulaGraph (vesoft-inc nebula) through version 3.8.0 lets any network-reachable attacker read and rewrite daemon gflags via the built-in web service. Because the service in src/webservice/WebService.cpp binds to all interfaces with no authentication, token, or address restriction, an attacker can harvest sensitive paths (certificate, key, CA, and password-file locations) and disable transport-security flags, redirect logging, and weaken lockout controls without a restart. No public exploit is identified at time of analysis, but the flaw is trivial to trigger and was reported by VulnCheck.
Out-of-bounds heap read in TIER IV Nebula's Vlp32Decoder::unpack() function through version 1.2.0 enables unauthenticated remote attackers to inject fabricated LiDAR point data into autonomous vehicle perception pipelines by sending short malformed UDP datagrams to the Velodyne sensor port. Unlike other Nebula sensor drivers, the VLP-32 UDP listener enforces no sender-address restrictions, making any network-reachable host a valid attacker origin without spoofing. Fabricated points derived from adjacent heap memory contents are silently published into downstream PointCloud2 messages consumed by Autoware nodes, creating a sensor-integrity risk with direct safety implications; no public exploit code and no CISA KEV listing are identified at time of analysis.
Nebula is a scalable overlay networking tool. [CVSS 8.1 HIGH]
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.