CVE-2026-81032
Received Received - Intake

Unauthenticated Configuration Modification in NebulaGraph

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-81032
EUVD
EUVD-2026-66608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nebulagraph nebulagraph 3.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NebulaGraph exposes its runtime configuration through an unauthenticated HTTP service running on all interfaces by default. This service allows reading and writing gflags (runtime flags) without any authentication or restrictions. Attackers can access sensitive paths like certificate files, password files, and data directories, or modify critical settings such as disabling transport security or changing authentication-related flags.

Detection Guidance

Scan your network for open HTTP ports on NebulaGraph daemons. Check for unauthenticated access to runtime configuration endpoints. Use tools like curl to query http://<target-ip>:<port>/flags or similar paths to see if gflags are exposed without authentication.

Impact Analysis

An attacker could exploit this to gain full control over the NebulaGraph daemon. They could disable security features, redirect logs, alter authentication settings, or access sensitive files like certificates and passwords. This could lead to data breaches, unauthorized access, or complete compromise of the database system.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. It exposes sensitive configuration data and allows unauthorized modifications, which could lead to unauthorized data access or loss. Organizations using NebulaGraph may fail GDPR (data protection) or HIPAA (health data security) compliance due to insufficient access controls and data exposure risks.

Mitigation Strategies

Restrict access to the HTTP service by binding it to localhost only or using a firewall. Enable authentication if possible. Disable the write route by ensuring the enable_authorize flag is set to true. Update to the latest version if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81032. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart