CVE-2026-81032: NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration
NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read route returns the daemon's full set of runtime flag values, which includes the configured certificate, key and certificate-authority paths, the password file path, data directories and the transport-security enable flags. The write route parses a supplied map and applies each entry through the gflags runtime setter, so a caller able to reach the port can change the daemon's behaviour without restarting it, including disabling the transport-security flags, redirecting log files and altering flags such as failedloginattempts and passwordlocktimeinsecs. Public reports of this endpoint describe a single name, enableauthorize, being refused by the handler; at release 3.8.0 that refusal is not present and the handler applies every name it is given.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
NebulaGraph daemons through 3.8.0 start the affected HTTP service with a bind address that defaults to all interfaces. Any daemon whose service port is reachable by an attacker is exposed, because the routes have no authentication, token check, or address restriction.
What does an attacker need to exploit this issue?
An attacker needs only network access to the daemon's HTTP service port. No credentials, prior access, or user interaction are required.
What can an unauthenticated caller do through the service?
A caller can read the daemon's full runtime flag set, including certificate, key, certificate-authority, password-file, data-directory, and transport-security paths or settings. A caller can also submit runtime flag changes, including disabling transport security, redirecting logs, and changing failed-login and password-lock settings.
What can be done if patching is not immediately possible?
Restrict network access to the daemon's HTTP service port so untrusted systems cannot reach it. Because the default bind address is all interfaces and the service has no built-in authentication or address restriction, network-level exposure must be controlled externally.
Does the write handler block any configuration names?
At release 3.8.0, the handler applies every supplied flag name. Although public reports describe enable_authorize as refused, that refusal is not present in 3.8.0.