CVE-2026-25768

Description

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.

PUBLISHED Reserved 2026-02-05 | Published 2026-02-12 | Updated 2026-02-12 | Assigner GitHub_M

Problem types

CWE-862: Missing Authorization

Product status

References

github.com/...avinmq/security/advisories/GHSA-r2mh-8vq6-qf7m

github.com/cloudamqp/lavinmq/pull/1669

github.com/...ommit/e871f8d0a53685f04e39e6410a2421c1f82803b0

cve.org (CVE-2026-25768)

nvd.nist.gov (CVE-2026-25768)

Download JSON