Read the docs
TI-2026-56235 Aliases CVE-2026-81505GHSA-p5vg-v7mj-f6q4

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Priority MEDIUM 64CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed convoy (frain-dev): 26.6.8github.com/frain-dev/convoy (Go): 0.9.3-0.20260724092134-1cc67cd16fb1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frain-devconvoybefore 26.6.826.6.8Patch availableCNA
—github.com/frain-dev/convoy (Go)before 0.9.3-0.20260724092134-1cc67cd16fb10.9.3-0.20260724092134-1cc67cd16fb1Patch availableGHSA-p5vg-v7mj-f6q4
  • convoy Vendorfrain-dev Affected before 26.6.8 Fixed in 26.6.8 Patch available CNA
  • github.com/frain-dev/convoy (Go) Vendor— Affected before 0.9.3-0.20260724092134-1cc67cd16fb1 Fixed in 0.9.3-0.20260724092134-1cc67cd16fb1 Patch available GHSA-p5vg-v7mj-f6q4

Remediation

  • Fix · CNA convoy (frain-dev) Fixed in 26.6.8
  • Fix · GHSA-p5vg-v7mj-f6q4 github.com/frain-dev/convoy (Go) Fixed in 0.9.3-0.20260724092134-1cc67cd16fb1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-81505
  2. 2026-10-03 Alias added: GHSA-p5vg-v7mj-f6q4

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences