CVE-2026-25767
Last modified
CVE-2026-25767 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 84codes | Lavinmq | < 2.6.8 |
References
- https://github.com/cloudamqp/lavinmq/pull/1670Issue Tracking, Patch
- https://github.com/cloudamqp/lavinmq/pull/1687Issue Tracking, Patch
- https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-wh37-6vrr-r9wgMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-25767?
How severe is CVE-2026-25767?
How do I fix CVE-2026-25767?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-25761Super-linter is a combination of multiple linters to run as …8.8
- CVE-2026-25762AdonisJS is a TypeScript-first web framework. Prior to versi…7.5
- CVE-2026-25763OpenProject is an open-source, web-based project management …9.9
- CVE-2026-25764OpenProject is an open-source, web-based project management …3.5
- CVE-2026-25765Faraday is an HTTP client library abstraction layer that pro…5.8
- CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
- CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
- CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
- CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10
- CVE-2026-25770Wazuh is a free and open source platform used for threat pre…7.2
- CVE-2026-25771Wazuh is a free and open source platform used for threat pre…7.5
- CVE-2026-25772Wazuh is a free and open source platform used for threat pre…7.2
Are you affected by CVE-2026-25767?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST