NebulaGraph graphd/metad/storaged each start an unauthenticated HTTP service (WebService.cpp) bound to all interfaces by default (ws_ip=0.0.0.0), with routes to read and write runtime gflags — no auth, token, or source restriction. A reachable attacker dumps config (cert/key/CA paths, data dirs, TLS flags) and changes daemon behavior live. CVSS ~9.3–9.8 (Critical). Not Slack Nebula VPN.

Affected: NebulaGraph community through 3.8.0.

Upgrade: none yet — wait for a Vesoft fix after 3.8.0.