CVE-2026-25767

LavinMQ has incomplete shovel configuration validation

CVSS 8.6 HIGHEPSS 0.3%CWE-863

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

12 fev 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

cloudamqp · lavinmq

Referências

https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82 https://github.com/cloudamqp/lavinmq/pull/1670 https://github.com/cloudamqp/lavinmq/pull/1687 https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg