A critical vulnerability in NebulaGraph allows unauthenticated remote attackers to read sensitive configuration data and modify daemon behavior, posing a severe risk to system security.

The application exposes an unauthenticated HTTP service that binds to all interfaces by default. This service provides endpoints to read runtime configuration and write gflags, allowing any unauthenticated remote caller to manipulate internal daemon settings.

Successful exploitation allows an attacker to gain full control over the runtime behavior of the NebulaGraph daemon. By modifying gflags, an attacker can disable transport-security, redirect logs, or alter authentication settings, potentially leading to total system compromise and unauthorized data access. The CVSS score of 9.8 reflects the high severity of this unauthenticated, remote-exploitable flaw.

Immediate Action: Update vesoft-inc nebula to the latest patched version available from the vendor to resolve the unauthenticated access issue.

Proactive Monitoring: Review access logs for suspicious PUT requests to the HTTP service endpoints, particularly those attempting to modify gflags or runtime parameters.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall (WAF) to restrict access to the NebulaGraph web service port (typically 11000 or 12000) to authorized management IP addresses only.

Public Exploit Available: No (Exploit available: false)

Given the critical severity of this vulnerability and the ease of exploitation, immediate action is required. Organizations should prioritize updating their NebulaGraph instances and ensure that the management interface is not exposed to untrusted networks. Failure to address this flaw leaves critical database infrastructure open to trivial remote configuration manipulation.