CVE-2026-25767 json
LavinMQ has incomplete shovel configuration validation
published 2026-02-12 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-6692
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
Patch / fix
- 84codes lavinmq 2.6.8
- github.com/cloudamqp/lavinmq@3a83e58 commit
- github.com/cloudamqp/lavinmq@be03da3 commit
- github.com/cloudamqp/lavinmq#1670 pull request
- github.com/cloudamqp/lavinmq#1687 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
- cloudamqp lavinmq
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/cloudamqp/lavinmq/pull/1670
issue-tracking, patch
-
github.com
/cloudamqp/lavinmq/pull/1687
issue-tracking, patch
-
github.com
/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a
patch
-
github.com
/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82
patch
-
github.com
/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg
mitigation, vendor-advisory
Sources
- CVE List CVE-2026-25767
- NVD CVE-2026-25767
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.