CVE-2026-111999 in Vanus
Summary
by MITRE • 10/18/2026
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in Vanus versions 0.8.0 through 0.9.0 represents a critical failure in access control mechanisms within the application's HTTP gateway layer. This flaw specifically affects the CloudEvents HTTP receiver, which is designed to accept event data from external sources and route it into internal event buses for processing by downstream subscribers. The core technical deficiency lies in the authentication middleware configuration, where specific API endpoints fail to enforce mandatory token validation before accepting incoming requests. Consequently, any remote attacker with network connectivity to the Vanus gateway can interact directly with these exposed interfaces without providing valid credentials or security tokens that would normally be required for such operations.
The exploitation of this vulnerability allows unauthenticated actors to publish arbitrary events into any accessible event bus within the targeted environment. Attackers achieve this by sending forged CloudEvents payloads to two distinct endpoint patterns: the modern namespace-specific path located at /namespaces/{ns}/eventbus/{name}/events and the legacy gateway path found at /gateway/{name}. The application logic in these versions incorrectly bypasses both token authentication checks and internal authorization rules designated as authPublish. This means that even if global authentication is enabled for other parts of the system, these specific entry points remain wide open to public access, effectively nullifying the security perimeter intended by the deployment configuration.
The operational impact of this vulnerability is severe due to the central role event buses play in modern microservice architectures and serverless environments. Once an attacker successfully publishes a forged event, it is stored within the bus and subsequently delivered to all configured subscription sinks. This can lead to data integrity violations where malicious or corrupted data propagates through downstream services that trust the source of events as legitimate system-generated traffic. In worst-case scenarios, if these subscriptions trigger automated workflows or function invocations, an attacker could potentially induce denial-of-service conditions by flooding systems with high-volume fake events or manipulate application logic by injecting payloads designed to exploit subsequent processing vulnerabilities in connected microservices.
From a classification perspective, this issue aligns directly with CWE-287, which describes Improper Authentication, as the system fails to verify identity before granting access to sensitive functionality. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this context it represents unauthorized use of valid endpoints without any account credentials at all, effectively bypassing authentication controls entirely. The ability to inject data into message queues is a precursor for more advanced attacks such as supply chain compromise or lateral movement within the internal network if those events trigger further actions across service boundaries.
To mitigate this vulnerability, organizations running Vanus versions 0.8.0 through 0.9.0 should immediately upgrade to a patched version where these authentication checks are correctly enforced on all gateway endpoints. Until an upgrade is possible, administrators can implement network-level controls such as firewall rules or reverse proxy configurations to restrict access to the /namespaces and /gateway paths exclusively from trusted internal IP ranges known to be legitimate event producers. Additionally, enabling strict input validation and rate limiting at the edge of the network can help reduce the blast radius by filtering out malformed CloudEvents payloads before they reach the vulnerable application logic. Monitoring logs for unusual spikes in HTTP POST requests to these specific endpoints can also aid in early detection of exploitation attempts while remediation efforts are underway.