{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81032 exists.","fix":"No fix has been published for CVE-2026-81032 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-81032 is a critical missing authorization vulnerability in vesoft-inc nebula, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-81032 and fix it if it is affected.\n\nWhat it is: CVE-2026-81032 is a critical missing authorization vulnerability in vesoft-inc nebula, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81032 exists.\n\nAffected product: vesoft-inc nebula. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-81032/ (Markdown: https://insights.sbomify.com/CVE-2026-81032/index.md)","id":"CVE-2026-81032","markdown":"https://insights.sbomify.com/CVE-2026-81032/index.md","name":"CVE-2026-81032","record":{"aliases":["GHSA-c937-9ccf-7mq9"],"analysis":{"component_type":"database","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"NebulaGraph database","requires_auth":"none","summary":"Unauthenticated attackers can read and modify NebulaGraph runtime configuration, potentially disabling security features and altering authentication settings.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"description":"NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration","id":"CVE-2026-81032","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy","id":"CVE-2026-81033"},"packages":[],"prev":{"headline":"IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update","id":"CVE-2026-81031"},"products":["nebula"],"published":"2026-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-26","vendors":["vesoft-inc"]},"summary":"Unauthenticated attackers can read and modify NebulaGraph runtime configuration, potentially disabling security features and altering authentication settings.","url":"https://insights.sbomify.com/CVE-2026-81032/"}