CVE-2026-19898: 
Wolfi vulnerability analysis and mitigation

CVE-2026-19898 is a missing brute-force protection vulnerability in the VMAuth authentication endpoint of VictoriaMetrics, affecting all versions up to and including 1.146.0. The flaw resides in the requestHandler function within app/vmauth/main.go, which fails to impose any rate limiting, account lockout, or throttling on failed authentication attempts. It was disclosed on August 15, 2026, with a patch released in version 1.147.0. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 2.9 (Low) (GitHub Advisory, VulDB).

The root cause is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-799 (Improper Control of Interaction Frequency). The requestHandler function in app/vmauth/main.go processes HTTP Basic Auth credentials by calling getUserInfoByAuthTokens, but returns a 401 Unauthorized response immediately upon failure with no delay, lockout, or rate-limiting mechanism. This allows a remote, unauthenticated attacker to submit unlimited credential guessing attempts at high speed — potentially thousands of requests per second — against any VMAuth-protected endpoint. A public proof-of-concept Python script demonstrating multi-threaded brute-force attacks was included in the original GitHub issue report (GitHub Issue #11180, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to conduct unlimited brute-force, password spraying, dictionary, or credential stuffing attacks against VMAuth-protected endpoints. If valid credentials are discovered, the attacker gains unauthorized access to the metrics infrastructure proxied by VMAuth, potentially exposing sensitive monitoring data, time series metrics, and any downstream VictoriaMetrics components. The confidentiality impact is limited (low), with no direct integrity or availability impact from the vulnerability itself, though compromised credentials could enable further lateral movement within the monitoring environment (GitHub Issue #11180, GitHub Advisory).

A public proof-of-concept brute-force script was published as part of the original vulnerability disclosure in GitHub Issue #11180, demonstrating multi-threaded credential guessing with no rate-limit detection (GitHub Issue #11180). The EPSS score is 0.0, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion at this time. Attack complexity is rated High due to the need to identify valid usernames and the inherent uncertainty of credential guessing, though the absence of any server-side throttling significantly lowers the practical barrier (VulDB, GitHub Advisory).

1. Reconnaissance: Identify internet-facing VMAuth instances (default port 8427) using tools like Shodan or Censys, targeting VictoriaMetrics deployments running version 1.146.0 or earlier.
2. Verify authentication requirement: Send an unauthenticated GET request to the VMAuth endpoint (e.g., GET http://<target>:8427/) and confirm an HTTP 401 Unauthorized response, indicating the endpoint requires credentials.
3. Prepare credential lists: Assemble a password wordlist (common passwords, default credentials such as admin, password, victoria, metrics) and optionally a username list.
4. Launch brute-force attack: Use the public PoC script or a tool like Hydra/Burp Intruder to send concurrent HTTP Basic Auth requests to the VMAuth endpoint. Since no rate limiting exists, thousands of attempts per second are possible:

   python3 poc_LOGIN_002_bruteforce.py http://<target>:8427 wordlist.txt admin -t 20

5. Identify valid credentials: Monitor HTTP responses — a status code of 200, 302, or non-401 indicates successful authentication.
6. Access protected resources: Use discovered credentials to authenticate to VMAuth and access proxied VictoriaMetrics APIs, query sensitive metrics data, or pivot to downstream monitoring infrastructure (GitHub Issue #11180).

• Network: High volume of HTTP requests to VMAuth endpoint (default port 8427) with Authorization: Basic headers from a single or rotating source IP; rapid sequential or concurrent authentication attempts with varying credentials.
• Logs: Elevated counts of the vmauth_http_request_errors_total{reason="invalid_auth_token"} metric in VMAuth telemetry; access logs showing repeated 401 responses to the same or similar endpoints from the same source IP.
• Process/Behavior: Unusual spikes in VMAuth request processing load without corresponding legitimate traffic increases; authentication attempts using common default usernames (admin, root, guest, prometheus) (GitHub Issue #11180, Patch Commit).

Upgrade VictoriaMetrics to version 1.147.0 or later, which introduces a randomized 2–3 second delay before returning 401 Unauthorized responses to failed authentication attempts, as recommended by OWASP Top 10 (A07:2025 Authentication Failures). The fix is implemented via the slowdownUnauthorizedResponse function in app/vmauth/main.go (patch commit 119ba0fb5be8024d50c5ba946599b2e69e8803ea). As compensating controls for environments that cannot immediately upgrade, implement network-level rate limiting (e.g., via a reverse proxy or WAF) on the VMAuth port, restrict VMAuth access to trusted IP ranges, and enable monitoring of the vmauth_http_request_errors_total{reason="invalid_auth_token"} metric with alerting on anomalous spikes. Version 1.147.0 also adds an InvalidAuthTokenRequestErrors alerting rule and enhanced logging of source IPs for failed auth attempts to aid detection (Patch Commit, v1.147.0 Release).

The VictoriaMetrics maintainer team responded promptly, merging the fix (PR #11195) and releasing it in v1.147.0 on July 6, 2026. The changelog explicitly references OWASP Top 10 A07:2025 as the basis for the mitigation approach. The issue was labeled security, enhancement, and vmauth by maintainers, and the fix also introduced a new alerting rule (InvalidAuthTokenRequestErrors) to help operators detect brute-force activity going forward (v1.147.0 Release, GitHub Issue #11180).