CVE-2026-112000: Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Vanus user can exploit the affected gateway RPC authorization gaps. No additional privileges or user interaction are required.
What access could an attacker gain through a stolen subscription ID?
An attacker can use another tenant's subscription ID with Subscribe to hijack the subscription, read its events, and acknowledge them. This can starve the legitimate consumer of events.
Are users and subscriptions in other tenants exposed?
Yes. The issue allows an authenticated user to target another tenant's subscription by supplying its subscription ID. The ListUser method can also be used to enumerate cluster users.
Which deployments are affected?
Vanus versions 0.8.0 through 0.9.0 are affected. The vulnerable behavior is in gateway streaming RPC authorization checks, so deployments exposing and using the gateway with authenticated users are relevant.