CVE-2026-112000 is a high severity (CVSS 7.6) missing authorization flaw in Vanus 0.8.0 through 0.9.0. Any authenticated user can call Subscribe, Ack and other methods without permission checks and hijack another tenant's subscription. The record names no fixed version. The sections below cover affected versions, how to check, and what to do first.
What's affected
Vanus 0.8.0 through 0.9.0, per the record and VulnCheck. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record says the gateway lets any authenticated user call Subscribe, Ack and unregistered methods without permission checks. Supplying another tenant's subscription ID allows reading and acknowledging its events, which starves the real consumer. ListUser also lets users enumerate the cluster.
Scoring note: the record's 7.6 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.2 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm your Vanus version. Then review who holds valid credentials to the gateway, since any of them can reach the flaw.
If you can see subscription activity, look for consumers that stopped receiving events, which fits the starvation the record describes, and for clients reading subscriptions they did not create.
What to do now
- Find your Vanus deployments and versions.
- Limit gateway credentials to the services that need them.
- Use separate clusters for tenants that must not see each other.
- Review subscription activity for unexpected consumers.
- Rotate gateway credentials if you find signs of misuse.
- Upgrade once a fixed release is confirmed.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Keep a record of what you checked and what you changed. Note the version found, the date, the action taken and who approved it. If the advisory is later updated, for example with a fixed release, you will know which systems need another pass, and an auditor or a colleague can follow your reasoning.
Why it matters
This is CWE-862, missing authorization. The gateway knows who the caller is but does not decide what that caller may do for several methods. An unknown method falls through without a check, which is the dangerous default.
The better design is deny by default: every method needs an explicit rule, and unlisted ones fail. Here the result is cross tenant reading of event streams and loss of events for the real consumer. It is not listed in CISA KEV.
Quick check
What does deny by default mean?
A method with no explicit permission rule is refused, instead of allowed.
Who can exploit this?
Any authenticated user, per the record.
Sources
Last reviewed: 18 October 2026.
