PT-2026-7897 · Lavinmq · Lavinmq

Moderatedentarg · Publicado 2026-02-12 · Atualizado 2026-02-12 · CVE-2026-25768

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LavinMQ versions prior to 2.6.6

Description An authenticated user could access metadata within the broker that they were not authorized to view.

Recommendations Update to version 2.6.6 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-25768

GHSA-R2MH-8VQ6-QF7M

Produtos afetados

Lavinmq

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25768.json · Exploit
• https://github.com/cloudamqp/lavinmq/pull/1669 · Correção
• https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0 · Correção
• https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25768 · Nota de Segurança
• https://twitter.com/CVEnew/status/2022037591323795563 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25768 · Aviso do Fabricante