CVE-2026-19898

LOW 3.7

VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended.

CWE	CWE-307 CWE-799
Vendor	n/a
Product	victoriametrics
Published	Aug 15, 2026

Stay Ahead of the Next One

Get instant alerts for n/a victoriametrics

Be the first to know when new low vulnerabilities affecting n/a victoriametrics are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / VictoriaMetrics

1.146

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/390088 vuldb.com: https://vuldb.com/vuln/390088/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19898 vuldb.com: https://vuldb.com/submit/870679 github.com: https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11180 github.com: https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-c7pm-322g-r9gf github.com: https://github.com/VictoriaMetrics/VictoriaMetrics/commit/119ba0fb5be8024d50c5ba946599b2e69e8803ea github.com: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.147.0 github.com: https://github.com/VictoriaMetrics/VictoriaMetrics/

Credits

🔍 ZAST.AI (VulDB User)