NebulaGraph exposes its full runtime configuration via an unauthenticated HTTP service that binds to all interfaces by default. Each daemon registers read and write routes for gflags with no authentication, token validation, or address restriction. The read route leaks sensitive paths including certificates, keys, CA paths, password files, and data directories. The write route allows any caller to modify runtime flags without restarting the daemon, enabling an attacker to disable transport security, redirect logs, or alter security-relevant flags like failed_login_attempts and password_lock_time_in_secs. In version 3.8.0, a previously documented restriction on the enable_authorize flag is absent, meaning the handler now applies every flag it receives. This represents a critical unauthenticated configuration tampering and information disclosure vulnerability affecting NebulaGraph through version 3.8.0.
