CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionNVD
LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
AnalysisAI
Authenticated users holding the Policymaker tag in LavinMQ prior to version 2.6.8 can create shovels that bypass access controls, allowing them to read from or publish messages to unauthorized virtual hosts. This privilege escalation vulnerability affects multi-tenant deployments where access segregation is critical. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all LavinMQ deployments and identify users with 'Policymaker' tag; immediately audit recent shovel creation activity for suspicious patterns. Within 7 days: Apply vendor patch to upgrade LavinMQ to version 2.6.8 or later across all affected systems. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today