CVE-2026-112000
7.6HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-862
Impact
Authenticated attackers can hijack other tenants' event subscriptions, read and acknowledge sensitive events, starve legitimate consumers, and enumerate all cluster users. They need network access to the gateway and valid low-privilege credentials.
Root cause
The gateway's authentication interceptor omits authorization checks on Subscribe, Ack, and unregistered RPC methods.
Affected systems
Vanus 0.8.0 through 0.9.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Fix & remediation
Upgrade to a fixed version once released by the vendor, or restrict network access to the Vanus gateway to trusted services only while blocking untrusted tenant access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
References
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300
- https://github.com/vanus-labs/vanus/issues/647
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs