7.6Yüksek
CVE-2026-112000Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
Açıklama
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
Zayıflık türü (CWE):
CWE-862
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| vanus-labs | vanus | 0.8.0 – ≤ 0.9.0 |
Kaynaklar ve yamalar
- https://github.com/vanus-labs/vanus/issues/647 issue-tracking
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40 technical-description
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110 technical-description
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300 technical-description
- VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs third-party-advisory