Missing Authorization in Vanus Gateway Subscription Methods

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Vanus versions 0.8.0 through 0.9.0 suffer from a critical missing authorization flaw in the gateway component that fails to validate permissions before allowing authenticated users to call Subscribe, Ack, and other unregistered methods. This vulnerability is particularly dangerous because it operates at the privilege escalation layer—any authenticated user, regardless of their intended role or tenant, can manipulate subscription lifecycle operations. Attackers can hijack subscriptions belonging to other tenants by supplying arbitrary subscription IDs, effectively reading and acknowledging events intended for legitimate consumers, starving them of critical messages, and enumerating cluster users through the ListUser method. Organizations running Vanus in multi-tenant environments or those where subscription access control is critical to their event-driven architecture face immediate risk of data exfiltration, denial of service, and unauthorized system reconnaissance.

Casky.ai's 283 matching security skills, powered by Claude's extended reasoning capabilities, map this vulnerability pattern to MITRE ATT&ACK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection signals across multiple domains: lateral movement indicators showing authenticated sessions accessing resources outside their tenant scope (CWE-862: Missing Authorization), privilege escalation patterns where normal users execute administrative operations like subscription hijacking, and reconnaissance activity through ListUser enumeration. The platform's skill set would highlight the absence of authorization checks before method invocation, the ability to supply cross-tenant identifiers unchallenged, and the chain of events that enable subscription manipulation—allowing security teams to distinguish this authorization bypass from network-level access control issues and focus remediation on API gateway permission validation logic.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-112000.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-112000

Casky has 283 skills that investigate the attack patterns behind CVE-2026-112000. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn