CVE-2026-112000 Details
Description
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
A missing authorization vulnerability has been identified in Vanus versions 0.8.0 through 0.9.0. This vulnerability allows any authenticated user to invoke Subscribe, Ack, and unregistered methods in the gateway without proper permission checks. Exploitation of this vulnerability could lead to subscription hijacking, unauthorized event access and acknowledgment, disruption of legitimate consumers, and enumeration of cluster users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110 | [email protected] | Source CodeVendor |
| https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40 | [email protected] | Source CodeVendor |
| https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300 | [email protected] | Source CodeVendor |
| https://github.com/vanus-labs/vanus/issues/647 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vanus | >= 0.8.0, <= 0.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |