Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck

CVE-2026-112000Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

High 7.6

In plain English

A high-severity missing authorization in vanus from vanus-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

Affected products (as reported)

Vendor	Product	Versions
vanus-labs	vanus	0.8.0 – through 0.9.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/vanus-labs/vanus/issues/647 issue-tracking
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40 technical-description
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110 technical-description
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300 technical-description
VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs third-party-advisory