CVE-2026-111999: Missing Authentication for Critical Function in vanus-labs vanus

CVE-2026-111999 describes a missing authentication vulnerability in vanus-labs vanus versions 0.8.0 through 0.9.0. The flaw allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Specifically, attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} endpoints, bypassing token authentication and authorization checks (authPublish). This leads to unauthorized events being stored and delivered to subscription sinks.

The vulnerability enables unauthenticated attackers to inject arbitrary events into the vanus eventbus system, potentially causing unauthorized data injection, event manipulation, or disruption of event-driven workflows. Since authentication and authorization checks are bypassed, the integrity and trustworthiness of event data can be compromised. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, no required privileges or user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CloudEvents HTTP gateway endpoints and implement network-level controls to limit exposure. Monitor for unusual event publishing activity. Do not rely on token authentication or authPublish checks alone as they are bypassed by this vulnerability.