Vulnerability Description
LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 84Codes | Lavinmq | < 2.6.6 |
Related Weaknesses (CWE)
References
- https://github.com/cloudamqp/lavinmq/commit/e871f8d0a53685f04e39e6410a2421c1f828Patch
- https://github.com/cloudamqp/lavinmq/pull/1669Issue TrackingPatch
- https://github.com/cloudamqp/lavinmq/security/advisories/GHSA-r2mh-8vq6-qf7mVendor Advisory
FAQ
What is CVE-2026-25768?
CVE-2026-25768 is a vulnerability with a CVSS score of 6.5 (MEDIUM). LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2...
How severe is CVE-2026-25768?
CVE-2026-25768 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25768?
Check the references section above for vendor advisories and patch information. Affected products include: 84Codes Lavinmq.