CVE-2026-111999
Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
| CWE | CWE-306 |
| Vendor | vanus-labs |
| Product | vanus |
| Published | Oct 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for vanus-labs vanus
Be the first to know when new high vulnerabilities affecting vanus-labs vanus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
vanus-labs / vanus
0.8.0 ≤ 0.9.0
References
Credits
MJ DHURGESH