CVE-2026-112000 in Vanus
Summary
by MITRE • 10/18/2026
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in Vanus versions 0.8.0 through 0.9.0 represents a critical failure in access control mechanisms within the application gateway layer. Specifically, this flaw is classified as a Broken Access Control issue where the system fails to enforce proper authorization checks for specific API endpoints and operations. The core technical deficiency lies in the middleware or handler logic that processes requests for Subscribe, Acknowledge, and unregistered methods. Instead of validating whether the authenticated user possesses the necessary permissions for the requested resource, the gateway accepts these requests based solely on valid authentication credentials. This architectural oversight allows any authenticated entity to bypass intended security boundaries, effectively treating all users as having elevated privileges regarding event stream management operations.
From a technical perspective, the exploitation vector involves manipulating subscription identifiers and method parameters during API interactions. An attacker who has obtained valid credentials for an account can interact with the Subscribe endpoint by supplying a subscription ID that belongs to a different tenant or user within the same cluster. Because the system lacks authorization checks on this input, it associates the incoming connection with the target subscriber rather than the requesting user. This mechanism enables the hijacking of active subscriptions, allowing the attacker to intercept and read events intended for legitimate consumers. Furthermore, by sending Acknowledge commands for these hijacked messages, the attacker can manipulate the message delivery state, potentially causing data loss or confusion in downstream processing pipelines that rely on accurate acknowledgment statuses.
The operational impact of this vulnerability is severe, affecting both confidentiality and availability within multi-tenant environments. By hijacking subscriptions, an adversary gains unauthorized access to sensitive business events, leading to significant data leakage across organizational boundaries. Beyond the breach of confidentiality, the ability to acknowledge messages without being the legitimate consumer creates a denial-of-service condition for the rightful subscriber. The legitimate user will never receive those specific events because they have already been marked as acknowledged by the attacker, effectively starving them of critical information required for their business logic or operational workflows. This disruption can lead to cascading failures in systems that depend on real-time event streams for decision-making or automation tasks.
Additionally, the vulnerability extends beyond direct data interception and service disruption through the enumeration capabilities exposed via the ListUser method. Although primarily an authorization flaw regarding subscription management, the lack of strict access controls allows authenticated users to query user lists without appropriate restrictions. This functionality can be leveraged by attackers to map out the internal structure of the cluster, identifying active tenants, their roles, and potentially inferring organizational hierarchies or security postures. Such reconnaissance activities facilitate further targeted attacks against high-value targets within the ecosystem, as adversaries gain valuable intelligence about potential victims before launching more sophisticated exploits.
To mitigate this risk, immediate updates to Vanus versions prior to 0.9.1 are strongly recommended, as these releases address the missing authorization checks in the gateway layer. In environments where upgrading is not immediately feasible, network-level controls such as strict firewall rules and API gateways with robust policy enforcement can provide a temporary buffer by restricting access to vulnerable endpoints based on IP addresses or other non-authentication factors. It is also advisable to implement rigorous input validation and ensure that all subscription-related operations are strictly bound to the identity of the requesting user, verifying ownership before processing any Subscribe or Acknowledge requests. Regular security audits focusing on role-based access control implementations will help prevent similar misconfigurations in future deployments.
This vulnerability aligns with CWE-284 Improper Access Control and is relevant to MITRE ATT&CK technique T1078 Valid Accounts, as it exploits legitimate credentials to perform unauthorized actions. The ability to hijack subscriptions relates closely to data interception techniques found in lateral movement or collection phases of an attack lifecycle. Addressing this issue requires a comprehensive review of authentication versus authorization logic throughout the application stack, ensuring that every sensitive operation is explicitly checked against user permissions before execution.