CVE-2026-112000
highVanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregist…
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110 disclosure@vulncheck.com
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L... disclosure@vulncheck.com
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300 disclosure@vulncheck.com
- https://github.com/vanus-labs/vanus/issues/647 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-ga... disclosure@vulncheck.com