CVE-2026-111999
Received Received - Intake

Unauthenticated Event Publishing in Vanus 0.8.0 to 0.9.0

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulnCheck

Description
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111999
EUVD
EUVD-2026-103452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vanus-labs vanus 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111999 is a missing authentication vulnerability in Vanus versions 0.8.0 through 0.9.0. It allows unauthenticated remote attackers to publish events to any eventbus via the gateway CloudEvents HTTP receiver. The flaw exists because the gateway does not enforce authentication for specific endpoints, enabling attackers to bypass token authentication and authPublish checks by sending forged CloudEvents to /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths.

Detection Guidance

Check Vanus versions between 0.8.0 and 0.9.0 by running: vanus version. Inspect network traffic for unauthorized POST requests to /namespaces/{ns}/eventbus/{name}/events or /gateway/{name} endpoints. Monitor logs for CloudEvents submissions without valid authentication tokens.

Impact Analysis

This vulnerability allows attackers to publish unauthorized events to any eventbus in your Vanus deployment. These events could be stored and delivered to subscription sinks without proper authorization, potentially leading to data breaches, unauthorized data access, or manipulation of event streams. The impact includes loss of data integrity and confidentiality in systems relying on Vanus for event streaming.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. The lack of authentication could result in unauthorized data processing or disclosure, violating these regulations and potentially leading to legal penalties or loss of trust.

Mitigation Strategies

Upgrade Vanus to a patched version immediately. If upgrading is not possible, restrict access to the vulnerable endpoints via network firewalls or reverse proxy rules. Ensure all event publishing requires valid authentication tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart