CVE-2026-111999: Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Vanus versions 0.8.0 through 0.9.0 are affected when the gateway CloudEvents HTTP receiver is reachable by a remote attacker. The issue affects both the namespace eventbus endpoint and the legacy gateway endpoint.
Does an attacker need credentials or publish permission?
No. An unauthenticated remote attacker can send forged CloudEvents without token authentication or satisfying authPublish checks, and the events can be stored and delivered to subscription sinks.