CVE-2026-112000

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112000
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112000.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112000
Published
2026-10-18T11:38:25Z
Modified
2026-10-24T02:48:43Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
Details

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112000.json"
}
References

Affected packages

Git / github.com/vanus-labs/vanus

Affected ranges

Type
GIT
Repo
https://github.com/vanus-labs/vanus
Events
Introduced
d35053c35b480a011083395aa9ac688ef65b8b32
Last Affected
d76dc3af1f33225d87bee16a60f6918c046cba17
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.8.0"
                },
                {
                    "last_affected":  "0.9.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0.8.0"
                },
                {
                    "last_affected":  "0.9.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

client/v0.*
client/v0.8.0
client/v0.9.0
observability/v0.*
observability/v0.8.0
observability/v0.9.0
pkg/v0.*
pkg/v0.8.0
pkg/v0.9.0
proto/v0.*
proto/v0.8.0
proto/v0.9.0
raft/v0.*
raft/v0.8.0
raft/v0.9.0
v0.*
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112000.json"