CVE-2026-111999

{
  "etk_id": "ETK-2026-1971",
  "cve_id": "CVE-2026-111999",
  "display_id": "CVE-2026-111999",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-103452",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Missing authentication in Vanus gateway event publishing",
  "summary": "Vanus 0.8.0 through 0.9.0 does not enforce publisher authentication for event submission through its gateway HTTP CloudEvents receiver. An unauthenticated remote party that can reach the receiver can inject events into event buses, where they may be forwarded to configured subscribers.",
  "mitigation": "Restrict network access to the Vanus gateway HTTP receiver to trusted clients and block untrusted access to its event-publication routes. Upgrade to a vendor-provided corrected release when one is identified; no fixed version is recorded in the advisory.",
  "vendor": "vanus-labs",
  "product": "vanus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.8.0, <= 0.9.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "vanus",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0053,
  "epss_percentile": 0.4387,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 11.832365283333333,
  "t0_at": "2026-10-18T11:38:25.071000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T11:38:25.071000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T11:38:25.071000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111999"
    }
  }
}