Executive brief
Convoy is an event-delivery and message-broker integration platform. An insecure endpoint design allows any authenticated user to read other projects' message-broker configurations, including plaintext credentials (API keys, passwords) for services like RabbitMQ, Kafka, and Amazon SQS. In multi-tenant deployments, this leaks live third-party credentials across customer accounts.
Technical details
An Insecure Direct Object Reference (IDOR) flaw exists in the GetSource API endpoint (api/handlers/source.go, GET /api/v1/projects/{projectID}/sources/{sourceID}). The handler validates the caller's authorization against the project ID in the URL via retrieveProject(), then calls sources.Service.FindSourceByID() with both projectID and sourceID parameters. However, the underlying SQL query (fetchSourceByID in internal/sources/repo/queries.sql) ignores the projectID parameter entirely—it queries only on source ID with no project_id predicate. As a result, any authenticated user with access to at least one project can construct a request using another project's ID in the URL and an arbitrary source ID, and the endpoint will return that source's full configuration in plaintext, including pub_sub.*.auth.password fields. The fix requires adding a project_id predicate to the SQL query or re-validating source.ProjectID == project.UID in the handler before returning the record.
Affected products
- frain-dev Convoy up to and including v26.6.2
Timeline
- 2026-09-18: disclosed: GHSA-p5vg-v7mj-f6q4 published