CVE-2026-111999 is a high severity (CVSS 7.5) missing authentication flaw in Vanus 0.8.0 through 0.9.0. Unauthenticated callers can publish forged CloudEvents to any eventbus through the gateway. The record names no fixed version. The sections below cover affected versions, how to check, and what to do first.
What's affected
Vanus 0.8.0 through 0.9.0, per the record and VulnCheck. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The affected component is the gateway's CloudEvents HTTP receiver. The record says both the namespaced eventbus path and a legacy gateway path skip token authentication and publish authorization checks, so forged events are stored and delivered to subscription sinks.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm your Vanus version. Then check where the gateway is reachable. If it is open to networks outside your trusted services, anyone there can post events.
Review stored events for ones whose source or type does not match your producers, and check what your sinks did with them.
What to do now
- Find your Vanus deployments and versions.
- Restrict network access to the gateway to known producers.
- Put an authenticating proxy in front of the CloudEvents receiver.
- Review events and sink actions for forged entries.
- Make sinks validate events before they act on them.
- Watch the project for a fix and upgrade when one is confirmed.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-306, missing authentication for a critical function. The gateway has a token and publish authorization model, but the receiver paths in question do not enforce it. A feature that exists on paper protects nothing if one route skips it.
Integrity is the main loss. Forged events flow to downstream systems that trust the bus, so a bad event can trigger real actions. The project's issue tracker also holds a combined security report that lists related problems. It is not listed in CISA KEV.
Quick check
What is a CloudEvent?
A standard envelope for event data. Here, the gateway accepts them over HTTP and routes them to subscribers.
Why validate at the sink?
A sink that trusts every event inherits the bus's weaknesses. Validating there limits the damage.
Sources
Last reviewed: 18 October 2026.
