{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/convoy--26.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frain-dev:convoy:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-81505"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["convoy (\u003c= 26.6.2)"],"_cs_severities":["high"],"_cs_tags":["idor","credential-leak","api-security"],"_cs_type":"advisory","_cs_vendors":["frain-dev"],"content_html":"\u003cp\u003eConvoy (frain-dev/convoy) is affected by a cross-tenant Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-81505, which impacts all versions up to and including v26.6.2. The vulnerability exists within the \u003ccode\u003eGetSource\u003c/code\u003e API endpoint (\u003ccode\u003eGET /api/v1/projects/{projectID}/sources/{sourceID}\u003c/code\u003e). While the application correctly authorizes the caller against the \u003ccode\u003e{projectID}\u003c/code\u003e in the URL, the underlying database service \u003ccode\u003eFindSourceByID\u003c/code\u003e fails to filter the results by project ownership.\u003c/p\u003e\n\u003cp\u003eAn attacker with valid credentials for any project on a Convoy instance can supply the \u003ccode\u003esourceID\u003c/code\u003e of a victim's configuration to retrieve the full, unredacted Source record. The response includes plaintext credentials for integrated message brokers, such as AMQP, Kafka, SQS, and Google PubSub. This flaw permits unauthorized cross-tenant information disclosure, allowing any authenticated user to harvest live secrets from other organizations using the same Convoy instance. No patch is currently available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a Convoy instance using valid credentials or a project-scoped API key.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target \u003ccode\u003e{sourceID}\u003c/code\u003e (e.g., through trial-and-error, enumeration, or information leakage).\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious API request targeting the endpoint: \u003ccode\u003eGET /api/v1/projects/{own_project_id}/sources/{target_source_id}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Convoy API verifies that the user is authorized to access \u003ccode\u003e{own_project_id}\u003c/code\u003e and proceeds to the \u003ccode\u003eGetSource\u003c/code\u003e handler.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eGetSource\u003c/code\u003e handler calls \u003ccode\u003eFindSourceByID\u003c/code\u003e using the attacker-supplied \u003ccode\u003e{target_source_id}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe backend SQL query \u003ccode\u003efetchSourceByID\u003c/code\u003e ignores the project context and returns the requested record from the database.\u003c/li\u003e\n\u003cli\u003eThe API serializes the entire \u003ccode\u003eSource\u003c/code\u003e object, including sensitive \u003ccode\u003epub_sub.*.auth.password\u003c/code\u003e fields, into the JSON response.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to extract live broker credentials for unauthorized downstream access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive message broker credentials, including AMQP, Kafka, SQS, and Google PubSub secrets. In multi-tenant environments, this constitutes a direct cross-customer credential leak. This impact is critical as it provides attackers with the ability to intercept, inject, or disrupt message traffic within the victim's infrastructure, potentially leading to further compromise of backend services or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit Convoy logs for excessive 200 OK responses to the \u003ccode\u003e/api/v1/projects/*/sources/*\u003c/code\u003e endpoint that correlate with user accounts accessing multiple different projects.\u003c/li\u003e\n\u003cli\u003eImplement request monitoring to identify and block patterns of enumerating \u003ccode\u003esourceID\u003c/code\u003e values across different project paths.\u003c/li\u003e\n\u003cli\u003eSince no patch exists, restrict access to the Convoy management interface and API to trusted internal networks or authorized IP ranges.\u003c/li\u003e\n\u003cli\u003eRotate any credentials currently stored in Convoy Source configurations if the instance is exposed to untrusted users.\u003c/li\u003e\n\u003cli\u003eIf possible, disable or remove untrusted projects from instances hosting sensitive production configurations until a vendor patch for CVE-2026-81505 is released.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-18T19:50:47Z","date_published":"2026-09-18T19:50:47Z","id":"https://feed.craftedsignal.io/briefs/2026-09-convoy-idor/","summary":"Convoy versions up to and including 26.6.2 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to leak plaintext message broker credentials from other tenants.","title":"Cross-Tenant IDOR in Convoy API Exposes Broker Credentials","url":"https://feed.craftedsignal.io/briefs/2026-09-convoy-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Convoy (\u003c= 26.6.2)","version":"https://jsonfeed.org/version/1.1"}