CVE-2026-112000

EUVD-2026-103453
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.6 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 20.28%
Common Weakness Enumeration
References
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300
https://github.com/vanus-labs/vanus/issues/647
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs