---
id: CVE-2026-81032
title: >-
  NebulaGraph exposes its runtime configuration over an unauthenticated HTTP
  service
summary: >-
  NebulaGraph exposes its runtime configuration over an unauthenticated HTTP
  service. Each daemon starts the web service defined in
  src/webservice/WebService.cpp, whose bind address defaults to all interfaces,
  and registers routes for read…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-08-26'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81032'
references:
  - url: 'https://github.com/vesoft-inc/nebula'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/vesoft-inc/nebula/blob/v3.8.0/src/webservice/SetFlagsHandler.cpp
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/vesoft-inc/nebula/blob/v3.8.0/src/webservice/WebService.cpp
    label: disclosure@vulncheck.com
  - url: 'https://github.com/vesoft-inc/nebula/issues/6157'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nebulagraph-through-3.8.0-unauthenticated-read-and-modification-of-runtime-configuration
    label: disclosure@vulncheck.com
  - url: 'https://github.com/vesoft-inc/nebula/issues/6157'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00493
epssPercentile: 0.3969
ingestedAt: '2026-09-24T20:51:40.232Z'
---

## Overview

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failed_login_attempts and password_lock_time_in_secs. Public reports of this endpoint describe a single name, enable_authorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.