The vulnerability (CVE-2026-19898) affects VictoriaMetrics versions up to 1.146.0 in the VMAuth Authentication Endpoint component, specifically in the requestHandler function. It allows an attacker to bypass proper restrictions on excessive authentication attempts, potentially enabling brute force or denial of service scenarios. The attack vector is remote network access with no privileges or user interaction required, but the attack complexity is high. The vulnerability is classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). A fix is available by upgrading to version 1.147.0, which addresses the issue.

The vulnerability could allow an attacker to perform excessive authentication attempts without proper restriction, potentially leading to account lockouts or denial of service conditions. Confidentiality, integrity, and availability impacts are low or none as per the CVSS vector (only a low confidentiality impact). Exploitation is difficult due to high attack complexity and no known exploits in the wild have been reported.

Upgrade VictoriaMetrics to version 1.147.0 or later, which contains the official fix for this vulnerability. No other mitigations are specifically recommended.