Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by cloudamqp

    CVE-2026-25768 (GCVE-0-2026-25768)

    Vulnerability from nvd – Published: 2026-02-12 19:52 – Updated: 2026-02-12 21:01
    VLAI
    Title
    LavinMQ is missing vhost access control
    Summary
    LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    cloudamqp lavinmq Affected: < 2.6.6
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T21:00:38.552793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-12T21:01:28.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lavinmq",
          "vendor": "cloudamqp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LavinMQ is a high-performance message queue \u0026 streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-12T19:52:50.474Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1669",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1669"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0"
        }
      ],
      "source": {
        "advisory": "GHSA-r2mh-8vq6-qf7m",
        "discovery": "UNKNOWN"
      },
      "title": "LavinMQ is missing vhost access control"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25768",
    "datePublished": "2026-02-12T19:52:50.474Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-12T21:01:28.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-25767 (GCVE-0-2026-25767)

    Vulnerability from nvd – Published: 2026-02-12 19:49 – Updated: 2026-02-12 20:52
    VLAI
    Title
    LavinMQ has incomplete shovel configuration validation
    Summary
    LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
    Severity
    8.6 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    cloudamqp lavinmq Affected: < 2.6.8
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T20:52:07.681102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-12T20:52:24.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lavinmq",
          "vendor": "cloudamqp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LavinMQ is a high-performance message queue \u0026 streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-12T19:49:49.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1670",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1670"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1687",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1687"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82"
        }
      ],
      "source": {
        "advisory": "GHSA-wh37-6vrr-r9wg",
        "discovery": "UNKNOWN"
      },
      "title": "LavinMQ has incomplete shovel configuration validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25767",
    "datePublished": "2026-02-12T19:49:49.516Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-12T20:52:24.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-25768 (GCVE-0-2026-25768)

    Vulnerability from cvelistv5 – Published: 2026-02-12 19:52 – Updated: 2026-02-12 21:01
    VLAI
    Title
    LavinMQ is missing vhost access control
    Summary
    LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.
    Severity
    7.1 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    cloudamqp lavinmq Affected: < 2.6.6
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T21:00:38.552793Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-12T21:01:28.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lavinmq",
          "vendor": "cloudamqp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LavinMQ is a high-performance message queue \u0026 streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-12T19:52:50.474Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1669",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1669"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0"
        }
      ],
      "source": {
        "advisory": "GHSA-r2mh-8vq6-qf7m",
        "discovery": "UNKNOWN"
      },
      "title": "LavinMQ is missing vhost access control"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25768",
    "datePublished": "2026-02-12T19:52:50.474Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-12T21:01:28.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-25767 (GCVE-0-2026-25767)

    Vulnerability from cvelistv5 – Published: 2026-02-12 19:49 – Updated: 2026-02-12 20:52
    VLAI
    Title
    LavinMQ has incomplete shovel configuration validation
    Summary
    LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
    Severity
    8.6 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    Impacted products
    Vendor Product Version
    cloudamqp lavinmq Affected: < 2.6.8
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-12T20:52:07.681102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-12T20:52:24.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lavinmq",
          "vendor": "cloudamqp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LavinMQ is a high-performance message queue \u0026 streaming server. Before 2.6.8, an authenticated user, with the \u201cPolicymaker\u201d tag, could create shovels bypassing access controls. an authenticated user with the \"Policymaker\" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-12T19:49:49.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1670",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1670"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/pull/1687",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/pull/1687"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a"
        },
        {
          "name": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82"
        }
      ],
      "source": {
        "advisory": "GHSA-wh37-6vrr-r9wg",
        "discovery": "UNKNOWN"
      },
      "title": "LavinMQ has incomplete shovel configuration validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25767",
    "datePublished": "2026-02-12T19:49:49.516Z",
    "dateReserved": "2026-02-05T18:35:52.358Z",
    "dateUpdated": "2026-02-12T20:52:24.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}