CVE-2026-81505

HighCVSS 7.1

Published: 18/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

A vulnerability in Convoy (webhooks gateway) prior to 26.6.8 affects the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The endpoint authorizes access to the project in the URL, but Handler.GetSource fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials.

Risk Assessment

Sensitive credentials of other tenants may be disclosed, enabling unauthorized access to their systems.

Recommendation

Update Convoy to version 26.6.8 or later. Additionally, verify that the Source's ProjectID matches the authorized project.

Other vulnerabilities in Convoy

CVE-2026-33746Critical
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads – such as modifying the user_uuid claim – and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1.

Original NVD description (English source)

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS