PT-2026-7896 · Lavinmq · Lavinmq

Magnushoerberg · Publicado 2026-02-12 · Atualizado 2026-02-13 · CVE-2026-25767

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LavinMQ versions prior to 2.6.8

Description LavinMQ is a high-performance message queue and streaming server. An authenticated user with the “Policymaker” tag could create shovels bypassing access controls. Specifically, an authenticated user with the "Policymaker" management tag could read messages from virtual hosts (vhosts) they are not authorized to access or publish messages to vhosts they are not authorized to access. This occurs due to improper access control checks during shovel creation.

Recommendations Update LavinMQ to version 2.6.8 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-25767

GHSA-WH37-6VRR-R9WG

Produtos afetados

Lavinmq

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25767.json · Exploit
• https://github.com/cloudamqp/lavinmq/pull/1687 · Correção
• https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a · Correção
• https://github.com/cloudamqp/lavinmq/pull/1670 · Correção
• https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82 · Correção
• https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25767 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2022115369050071478 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2022037592343007466 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25767 · Nota de Segurança