PT-2026-7896 · Lavinmq · Lavinmq

Magnushoerberg · Published 2026-02-12 · Updated 2026-02-13 · CVE-2026-25767

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LavinMQ versions prior to 2.6.8

Description LavinMQ is a high-performance message queue and streaming server. An authenticated user with the “Policymaker” tag could create shovels bypassing access controls. Specifically, an authenticated user with the "Policymaker" management tag could read messages from virtual hosts (vhosts) they are not authorized to access or publish messages to vhosts they are not authorized to access. This occurs due to improper access control checks during shovel creation.

Recommendations Update LavinMQ to version 2.6.8 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25767

GHSA-WH37-6VRR-R9WG

Affected Products

Lavinmq

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25767.json · Exploit
• https://github.com/cloudamqp/lavinmq/pull/1687 · Patch
• https://github.com/cloudamqp/lavinmq/commit/3a83e5894495b60c7c32a79c3dbc9bd9fa237d9a · Patch
• https://github.com/cloudamqp/lavinmq/pull/1670 · Patch
• https://github.com/cloudamqp/lavinmq/commit/be03da31f3db1a2552f7094ff58e953ef50cdc82 · Patch
• https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25767 · Security Note
• https://twitter.com/VulmonFeeds/status/2022115369050071478 · Twitter Post
• https://twitter.com/CVEnew/status/2022037592343007466 · Twitter Post