High 7.1Published Sep 18, 2026

CVE-2026-81505Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

Updated under an hour ago (2026-10-19 08:30 UTC)

Does this affect you?

It affects frain-dev convoy. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for frain-dev convoy

Exploited in the last 30 days

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

CVSS: 7.1 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

frain-dev convoy frain_dev:convoy (from the name)	before 26.6.8	CNA record

References

https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4x-refsource-confirm
https://github.com/frain-dev/convoy/pull/2755x-refsource-misc
https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06x-refsource-misc
https://github.com/frain-dev/convoy/releases/tag/v26.6.8x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.