Vendor
NebulaGraph versions 3.8.0 and earlier contain an authentication bypass in the internal HTTP web service that allows unauthenticated remote attackers to read sensitive configuration and modify daemon behavior at runtime.