vesoft-inc vulnerabilities

Products

• github.com/vesoft-inc/nebula 3

Latest vesoft-inc CVEs

Newest publication first

1. CVE-2026-81032 NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

   Published 2026-08-26

   Critical·CVSS 9.3 EPSS 0.36%

   NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and...

2. CVE-2024-47218 CVE-2024-47218 in github.com/vesoft-inc/nebula

   Published 2024-09-22

   Critical·CVSS 9.8 EPSS 0.58%

   An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows bypassing authentication.

3. CVE-2024-47219 CVE-2024-47219 in github.com/vesoft-inc/nebula

   Published 2024-09-21

   Critical·CVSS 9.8 EPSS 1.2%

   An issue was discovered in vesoft NebulaGraph through 3.8.0. It allows shell command injection.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.