CVE-2026-81505Published
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-81505 · Microsoft / collected KEV context
cve-program · CVE-2026-81505
- https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4
- https://github.com/frain-dev/convoy/pull/2755
- https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06
- https://github.com/frain-dev/convoy/releases/tag/v26.6.8
euvd · EUVD-2026-83051
- https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4
- https://github.com/frain-dev/convoy/pull/2755
- https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06
- https://github.com/frain-dev/convoy/releases/tag/v26.6.8
nvd · CVE-2026-81505
- https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06
- https://github.com/frain-dev/convoy/pull/2755
- https://github.com/frain-dev/convoy/releases/tag/v26.6.8
- https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4
osv · GHSA-p5vg-v7mj-f6q4
- https://github.com/frain-dev/convoy/security/advisories/GHSA-p5vg-v7mj-f6q4
- https://github.com/frain-dev/convoy/pull/2755
- https://github.com/frain-dev/convoy/commit/1cc67cd16fb1f8890cc83a3998d3f92dceb7fd06
- https://github.com/frain-dev/convoy
- https://github.com/frain-dev/convoy/releases/tag/v26.6.8
osv · GO-2026-6523
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.