High severity · published Oct 18, 2026
CVE-2026-112000
Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
vanus · vanus-labs
0.8.0 through 0.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112000
github.com
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110
github.com
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40
github.com
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300
github.com
https://github.com/vanus-labs/vanus/issues/647
www.vulncheck.com
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs
More from vanus
9.8
CVE-2026-111998
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
7.5
CVE-2026-111999
Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver