Vanus 0.8.0 to 0.9.0 Vulnerabilities: Missing Authentication and Authorization

• •Vanus versions 0.8.0 to 0.9.0 are affected by critical authentication and authorization flaws.
• •The vulnerabilities could allow unauthorized access to sensitive functions within the software.
• •No active exploitation has been reported, but users should remain vigilant for updates.

Two significant vulnerabilities have been identified in Vanus versions 0.8.0 to 0.9.0. The first, a missing authentication flaw in the Gateway CloudEvents HTTP receiver, could allow unauthorized access to critical functions. The second vulnerability involves missing authorization in Gateway Streaming RPCs, which could similarly expose sensitive operations. Both vulnerabilities affect all installations of Vanus within the specified version range. No specific CVEs have been assigned yet, and there are no reports of. Users are advised to monitor for updates and apply patches as they become available. The vulnerabilities are categorized under CWE-306 for missing authentication and CWE-284 for missing authorization.