Executive brief
NebulaGraph, a distributed graph database, exposes an unauthenticated HTTP service that allows anyone on the network to read and modify the daemon's runtime configuration without authentication. An attacker can retrieve sensitive paths (certificate keys, password files, data directories) and disable security features like TLS, change authentication policies, or alter logging behavior—all without any credentials or access controls.
Technical details
The vulnerability is a missing authentication and authorization check in the WebService HTTP handler (src/webservice/WebService.cpp), which binds to all interfaces by default and registers routes for reading and writing gflags. The read endpoint (GetFlagsHandler) exposes the full set of runtime flag values including certificate paths, key file paths, data directories, and security-enable flags. The write endpoint (SetFlagsHandler) accepts arbitrary flag name-value pairs and applies them via the gflags runtime setter without validation or authorization, allowing an attacker with network access to disable transport security, redirect logs, or modify authentication parameters. Attack vector is network, requires only network reachability to the default HTTP port, and no authentication is needed. In version 3.8.0 and later, there is no allowlist enforcement (prior versions allegedly refused only the 'enable_authorize' flag), making all flags modifiable.
Affected products
- vesoft NebulaGraph 3.8.0 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-81032