Vanus 0.8.0 Through 0.9.0 Missing Authentication Via Gateway Cloudevents Http Receiver

Back www.vulncheck.com

Vanus 0.8.0 Through 0.9.0 Missing Authentication Via Gateway Cloudevents Http Receiver

www.vulncheck.com • October 18, 2026

Share: View original

Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver

vanus >= 0.8.0, = 0.8.0, <= 0.9.0

CWE-306 Missing Authentication for Critical Function

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vanus 0.8.0 to 0.9.0 Vulnerabilities: Missing Authentication and Authorization Two significant vulnerabilities have been identified in Vanus versions 0.8.0 to 0.9.0. The first, a missing authentication flaw in the Gateway CloudEvents HTTP receiver, could allow unauthorized access to critical functions. The second vulnerability involves missing authorization in Gateway Streaming RPCs, which could similarly expose sensitive operations. Both vulnerabilities affect all installations of Vanus within the specified version range. No specific CVEs have been assigned yet, and there are no reports of. Users are advised to monitor for updates and apply patches as they become available. The vulnerabilities are categorized under CWE-306 for missing authentication and CWE-284 for missing authorization. 39

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-306 - Missing Authentication For Critical Function

Platforms (3)

CloudEvents Gateway HTTP Receiver

Vulnerabilities (1)

Missing Authentication For Critical Function