{"metadata": {"vulnerability": "CVE-2026-81505", "count": 13, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-26T20:58:58.083Z", "date_only": false, "value": "2026-08-26T20:58:58.083Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-81505", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-18T16:21:17.278Z", "date_only": false, "value": "2026-09-18T16:21:17.278Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-81505", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-18T16:21:17.278Z", "date_only": false, "value": "2026-09-18T16:21:17.278Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-81505", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:15:17.178Z", "date_only": false, "value": "2026-09-18T17:15:17.178343Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-81505", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-18T17:15:17.178Z", "date_only": false, "value": "2026-09-18T17:15:17.178343Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81505", "record": "FKIE_CVE-2026-81505", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-18T17:15:48.985Z", "date_only": false, "value": "2026-09-18T17:15:48.985Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-81505", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:15:48.985Z", "date_only": false, "value": "2026-09-18T17:15:48.985Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-81505", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:17:02.103Z", "date_only": false, "value": "2026-09-18T17:17:02.103", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81505", "record": "FKIE_CVE-2026-81505", "field": "published"}, {"timestamp": "2026-09-18T17:17:45Z", "date_only": false, "value": "2026-09-18T17:17:45Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P5VG-V7MJ-F6Q4", "record": "GHSA-P5VG-V7MJ-F6Q4", "field": "published"}, {"timestamp": "2026-09-18T17:17:45Z", "date_only": false, "value": "2026-09-18T17:17:45Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P5VG-V7MJ-F6Q4", "record": "GHSA-P5VG-V7MJ-F6Q4", "field": "modified"}, {"timestamp": "2026-09-18T18:35:07.864Z", "date_only": false, "value": "2026-09-18T18:35:07.864265Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4", "record": "CVE-2026-81505", "field": "creation_timestamp", "uuid": "20b62f36-5f13-45e7-a3e6-614e13e1d2ad", "url": "https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4"}, {"timestamp": "2026-09-19T10:31:27.681Z", "date_only": false, "value": "2026-09-19T10:31:27.681429Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/9fb1086f5e4e9b47992fc238d03c86ef", "record": "CVE-2026-81505", "field": "creation_timestamp", "uuid": "1d277526-6bf8-4041-bcb5-521a2823c520", "content": "# CVE-2026-81505: CVE-2026-81505: Broken Object Level Authorization (BOLA) in Convoy Webhook Source Retrieval\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81505\n\n## Summary\nCVE-2026-81505 is a high-severity Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability in Convoy, a cloud-native webhooks gateway. In affected versions prior to 26.6.8, the single-item Source retrieval API endpoint authorizes project access but fails to confirm if the requested Source belongs to that specific project. This logical flaw allows authenticated users or project-scoped API key holders to bypass tenant isolation boundaries and retrieve unredacted, plaintext message broker credentials for Apache Kafka, Amazon SQS, RabbitMQ, and Google Cloud Pub/Sub belonging to other tenants. This issue is fully patched in version 26.6.8.\n\n## TL;DR\nConvoy versions prior to 26.6.8 allow low-privilege authenticated users or project-scoped API keys to bypass tenant isolation boundaries and extract unredacted message broker credentials of other projects by querying specific Source IDs.\n\n## Technical Details\n\n- **CWE ID**: CWE-639 (Authorization Bypass Through User-Controlled Key)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1 (High)\n- **EPSS Score**: Not Registered\n- **Impact**: Confidentiality: High (Plaintext credentials leak)\n- **Exploit Status**: None (No public PoCs)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Convoy control-plane configurations with multi-tenancy or project-level isolation enabled\n- **convoy**: < 26.6.8 (Fixed in: `26.6.8`)\n\n## Mitigation\n\n- Upgrade Convoy control-plane instances to version 26.6.8 or newer immediately.\n- Restrict project-scoped API key issuance to authorized and audited administrative accounts.\n- Isolate the Convoy control-plane API via network firewalls and access lists to minimize public exposure.\n- Establish centralized logging to monitor cross-tenant HTTP requests targeting the project endpoints.\n\n**Remediation Steps:**\n1. Identify all running Convoy gateway deployments and verify their current version.\n2. Pull the updated container image or binary for Convoy version v26.6.8.\n3. Apply the update to production, staging, and development environments.\n4. Confirm successful deployment by attempting a cross-project source lookup and verifying it returns a 404 (Not Found) error.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4)\n- [Patch Commit](https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06)\n- [Convoy v26.6.8 Release Notes](https://github.com/frain-dev/convoy/releases/tag/v26.6.8)\n- [NVD CVE Record](https://nvd.nist.gov/vuln/detail/CVE-2026-81505)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81505) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/9fb1086f5e4e9b47992fc238d03c86ef"}, {"timestamp": "2026-09-24T21:25:27.050Z", "date_only": false, "value": "2026-09-24T21:25:27.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-81505", "record": "FKIE_CVE-2026-81505", "field": "lastModified"}]}