Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25767 LavinMQ Authentication Bypass Vulnerability in Shovel Management Before 2.6.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25767
Post summary
A brief disclosure of an authentication bypass vulnerability in LavinMQ’s Shovel Management before v2.6.8, with no evidence of a PoC, exploit, active exploitation, or patch information.
CVE-2026-25767 LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access… https://www.cve.org/CVERecord?id=CVE-2026-25767
Post summary
CVE-2026-25767 exposes an authenticated privilege escalation in LavinMQ, allowing users with the "Policymaker" role to create shovels that bypass access controls in versions earlier than 2.6.8.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | 84codes | lavinmq | - | - | - |