Live › vulnerability › CVE-2026-111999
Go to dashboardVanus 0.8.0 through 0.9.0 (the latest release) accept CloudEvents over the gateway HTTP port (8081) with no authentication. A remote attacker can publish forged events to any eventbus via /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path; they are stored and delivered to subscription sinks, so they can fire downstream triggers. No patched release exists. The same upstream report (#647) also describes a default cluster-admin token 'admin', SSRF through subscription sinks and missing authorization; these are not covered by this CVE but make default deployments riskier.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vanus | github | >= 0.8.0, <= 0.9.0 | – |
vsctl version or check the image tag of the gateway/controller pods (e.g. kubectl get pods -o jsonpath for vanus images): 0.8.0 to 0.9.0 is affectedadminv0.9.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
This page as .md · .json · in your agent: get_signal("CVE-2026-111999")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.