Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-81505Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
High 7.1
In plain English
A high-severity authorization bypass via user-controlled key in convoy from frain-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/frain-dev/convoy | 0.9.3-0.20260724092134-1cc67cd16fb1 | GHSA-p5vg-v7mj-f6q4 |
| Go | github.com/frain-dev/convoy | 0.9.3-0.20260724092134-1cc67cd16fb1 | GO-2026-6523 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4 x_refsource_CONFIRM
- https://github.com/frain-dev/convoy/pull/2755 x_refsource_MISC
- https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06 x_refsource_MISC
- https://github.com/frain-dev/convoy/releases/tag/v26.6.8 x_refsource_MISC