PT-2026-7897 · Lavinmq · Lavinmq

Moderatedentarg · Published 2026-02-12 · Updated 2026-02-12 · CVE-2026-25768

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LavinMQ versions prior to 2.6.6

Description An authenticated user could access metadata within the broker that they were not authorized to view.

Recommendations Update to version 2.6.6 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25768

GHSA-R2MH-8VQ6-QF7M

Affected Products

Lavinmq

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25768.json · Exploit
• https://github.com/cloudamqp/lavinmq/pull/1669 · Patch
• https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f82803b0 · Patch
• https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25768 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25768 · Vendor Advisory
• https://twitter.com/CVEnew/status/2022037591323795563 · Twitter Post