CVE-2026-112000
HIGH
CVSS 7.6
Published: 2026-10-18
Modified: 2026-10-19
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
Quick Facts
| CVE ID | CVE-2026-112000 |
| CVSS Score | 7.6 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
| Published | 2026-10-18 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |