Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-111999Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

High 7.5

In plain English

A high-severity missing authentication in vanus from vanus-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

Affected products (as reported)

Vendor	Product	Versions
vanus-labs	vanus	0.8.0 – through 0.9.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/vanus-labs/vanus/issues/647 issue-tracking
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/gateway.go#L81-L124 technical-description
VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver third-party-advisory