Vanus CVE-2026-112000

Requires a valid authenticated account on the Vanus gateway (PR:L) and a multi-tenant deployment where the attacker can reference another tenant's subscription ID; the gateway's streaming RPCs (Subscribe, Ack) and unregistered methods perform no per-resource permission check, so exploitation needs no special non-default configuration beyond having more than one tenant/user. Limiting factors: the attacker must already be authenticated (single-tenant or single-user deployments have no cross-tenant victim to target), and impact is scoped to event data access, subscription hijack/denial, and user enumeration rather than host compromise. Affected only in versions 0.8.0 through 0.9.0.

This is a genuine but bounded authorization flaw rather than an inflated high-CVSS issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) scores 7.2 and is internally consistent with the description: network-reachable gateway RPCs, low attack complexity, and only low privileges (any valid authenticated/tenant account) required, yielding high confidentiality impact (reading another tenant's events and enumerating cluster users) plus lower integrity and availability impact (acking/hijacking subscriptions and starving consumers). No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit code was referenced - the references are the vendor source-code locations, a GitHub issue, and the VulnCheck advisory, which document the defect but are not weaponized exploits. Exploitation status is therefore 'no public exploit identified at time of analysis'; do NOT treat the VulnCheck advisory as evidence of in-the-wild use. Net priority is moderate: trivially exploitable by any authenticated tenant in multi-tenant deployments, but the real-world blast radius is constrained by Vanus's niche footprint and the precondition of already holding a valid account. Missing signals (EPSS, KEV, confirmed patched version) should be verified with the vendor before final prioritization.

A low-privileged but authenticated tenant on a shared Vanus gateway calls the Subscribe RPC supplying another tenant's subscription ID; because the gateway interceptor performs no per-resource authorization check, the attacker hijacks that subscription, reads and acknowledges the victim's events (starving the legitimate consumer), and additionally calls ListUser to enumerate all cluster users. No public exploit code is referenced, but the vendor advisory and the cited interceptor/proxy source lines make the flaw straightforward to reproduce.