CVE-2026-81032 NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration
Unauthenticated attackers can read and modify NebulaGraph runtime configuration, potentially disabling security features and altering authentication settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81032?
CVE-2026-81032 is a critical missing authorization vulnerability in vesoft-inc nebula, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
Weakness: CWE-306
Which versions are affected by CVE-2026-81032?
How do I fix CVE-2026-81032?
No fix has been published for CVE-2026-81032 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-81032 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81032 exists.
Sources
Also known as GHSA-c937-9ccf-7mq9.