CVE-2026-81505: Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Convoyto a version that resolves this vulnerability.Fixed in 26.6.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Convoy user or holder of a project-scoped API key can exploit it. They need a source identifier belonging to another tenant and access to the affected single-source endpoint.
Which endpoint is affected, and are source listings also exposed?
The affected endpoint is GET /api/v1/projects/{projectID}/sources/{sourceID}. The project-scoped list endpoint is not affected.
What information can be disclosed?
A successful cross-tenant lookup returns the complete Source record, including unredacted credentials for AMQP, Kafka, SQS, or Google PubSub.
How can I determine whether my deployment is affected?
Convoy versions prior to 26.6.8 are affected. The issue is present when a caller authorized for one project can request a Source ID from another project through the single-item source endpoint and receive its record.
What should be done to remediate the issue?
Upgrade Convoy to version 26.6.8, which fixes the authorization check. Until upgraded, restrict access to authenticated users and project-scoped API keys as tightly as possible, since either can invoke the affected endpoint.