Live › vulnerability › CVE-2026-112000
Go to dashboardVanus versions 0.8.0 through 0.9.0 let any authenticated user call Subscribe, Ack and unregistered gateway methods without permission checks. An attacker who knows another tenant's subscription ID can take over that subscription, read and acknowledge its events, starve the legitimate consumer, and list cluster users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Vanus 0.8.0-0.9.0 deployments where more than one tenant or untrusted user holds a valid gateway token. Any token holder can Subscribe to another tenant's subscription ID, read and ack its events, starve the real consumer, and list users (ListUser). Single-tenant or private-network setups where every token holder is trusted are at low risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vanus | github | >= 0.8.0, <= 0.9.0 | – |
0.8.0 through 0.9.0 is affected (the latest release is 0.9.0, so all releases from 0.8.0 on)// todo stream authorize stream interceptor, and auth.go returns nil for unknown methodsv0.9.0 is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
This page as .md · .json · in your agent: get_signal("CVE-2026-112000")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.