---
id: CVE-2026-112000
title: Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
summary: >-
  Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in
  the gateway that allows any authenticated user to call Subscribe, Ack, and
  unregistered methods without permission checks. Attackers can supply another
  tenant's …
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: vanus-labs
product: vanus
affected:
  - vanus >= 0.8.0 <= 0.9.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T11:38:25.755Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112000'
references:
  - url: 'https://github.com/vanus-labs/vanus/issues/647'
  - url: >-
      https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40
  - url: >-
      https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110
  - url: >-
      https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300
  - url: >-
      https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs
    label: >-
      VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Missing Authorization in
      Gateway Streaming RPCs
tags:
  - cve.org
ingestedAt: '2026-10-18T11:40:26.626Z'
---

## Overview

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

## Affected

- `vanus >= 0.8.0 <= 0.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.