CVE-2026-19898

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19898

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19898.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19898

Aliases

GHSA-c7pm-322g-r9gf

Published

2026-08-15T15:45:10.515Z

Modified

2026-08-17T03:47:32.314218182Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication

Details

A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended.

Database specific

{
    "cwe_ids": [
        "CWE-307",
        "CWE-799"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19898.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/victoriametrics/victoriametrics

Affected ranges

Type

GIT

Repo

https://github.com/victoriametrics/victoriametrics

Events

Introduced

e8cfb1e17236a7df5770fce768e29e48f1ccf49a

Fixed

119ba0fb5be8024d50c5ba946599b2e69e8803ea

Fixed

bc2d3c73340f9ebc16d0cf76591d556ef49d0cb2

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.146"
        },
        {
            "last_affected": "1.146"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.146

v1.*

v1.146.0-cluster

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19898.json"