CVE-2026-81505: Broken Object Level Authorization (BOLA) in Convoy Webhook Source Retrieval

Vulnerability ID: CVE-2026-81505
CVSS Score: 7.1
Published: 2026-09-18

CVE-2026-81505 is a high-severity Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability in Convoy, a cloud-native webhooks gateway. In affected versions prior to 26.6.8, the single-item Source retrieval API endpoint authorizes project access but fails to confirm if the requested Source belongs to that specific project. This logical flaw allows authenticated users or project-scoped API key holders to bypass tenant isolation boundaries and retrieve unredacted, plaintext message broker credentials for Apache Kafka, Amazon SQS, RabbitMQ, and Google Cloud Pub/Sub belonging to other tenants. This issue is fully patched in version 26.6.8.

TL;DR

Convoy versions prior to 26.6.8 allow low-privilege authenticated users or project-scoped API keys to bypass tenant isolation boundaries and extract unredacted message broker credentials of other projects by querying specific Source IDs.

Technical Details

• CWE ID: CWE-639 (Authorization Bypass Through User-Controlled Key)
• Attack Vector: Network (AV:N)
• CVSS v4.0 Score: 7.1 (High)
• EPSS Score: Not Registered
• Impact: Confidentiality: High (Plaintext credentials leak)
• Exploit Status: None (No public PoCs)
• KEV Status: Not Listed

Affected Systems

• Convoy control-plane configurations with multi-tenancy or project-level isolation enabled
• convoy: < 26.6.8 (Fixed in: 26.6.8)

Code Analysis

Commit: 1cc67cd

Fix project scoping in FindSourceByID to prevent cross-tenant credential exposure

@@ -10,6 +10,14 @@ func (s *Service) FindSourceByID(ctx context.Context, projectID, id string) (*da
        return nil, &ServiceError{ErrMsg: "error retrieving source", Err: err}
    }

-   return rowToSource(row)
+   source, err := rowToSource(row)
+   if err != nil {
+       return nil, err
+   }
+
+   if source.ProjectID != projectID {
+       return nil, datastore.ErrSourceNotFound
+   }
+
+   return source, nil
 }

Mitigation Strategies

• Upgrade Convoy control-plane instances to version 26.6.8 or newer immediately.
• Restrict project-scoped API key issuance to authorized and audited administrative accounts.
• Isolate the Convoy control-plane API via network firewalls and access lists to minimize public exposure.
• Establish centralized logging to monitor cross-tenant HTTP requests targeting the project endpoints.

Remediation Steps:

1. Identify all running Convoy gateway deployments and verify their current version.
2. Pull the updated container image or binary for Convoy version v26.6.8.
3. Apply the update to production, staging, and development environments.
4. Confirm successful deployment by attempting a cross-project source lookup and verifying it returns a 404 (Not Found) error.

References

• GitHub Security Advisory
• Patch Commit
• Convoy v26.6.8 Release Notes
• NVD CVE Record

Read the full report for CVE-2026-81505 on our website for more details including interactive diagrams and full exploit analysis.