CVE-2026-81032: Missing Authentication for Critical Function in vesoft-inc nebula

CVE-2026-81032 describes a missing authentication vulnerability in vesoft-inc's NebulaGraph product, affecting versions up to and including 3.8.0. The product exposes an unauthenticated HTTP service that allows reading and writing runtime configuration flags. The service binds to all interfaces by default and lacks authentication, token checks, or address restrictions. The read route discloses sensitive runtime flag values including certificate and password file paths. The write route permits unauthenticated callers to modify runtime flags dynamically, potentially disabling security features and altering operational parameters without restarting the daemon. Earlier reports indicated a single flag 'enable_authorize' was refused, but in version 3.8.0 this restriction is absent, allowing all flags to be set.

An attacker with network access to the exposed HTTP service can retrieve sensitive configuration details and modify runtime flags, potentially disabling security controls such as transport security and altering authentication parameters. This can lead to unauthorized access, reduced security posture, and operational disruptions. The vulnerability is critical with a CVSS 4.0 score of 9.3, indicating high impact and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected HTTP service to trusted hosts only, for example by firewall rules or network segmentation. Monitor for unusual configuration changes and consider disabling or restricting the web service if possible.