CVE-2026-90490
Received Received - Intake

Deserialization Vulnerability in lenve vhr 1.0-SNAPSHOT

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90490
EUVD
EUVD-2026-76931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rabbitmq rabbitmq_management *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a deserialization flaw in lenve vhr 1.0-SNAPSHOT, specifically in the MailReceiver component. An attacker can remotely manipulate data to trigger deserialization, which may lead to arbitrary code execution. The exploit has been publicly disclosed and a proof-of-concept is available.

Detection Guidance

Check for unauthorized file creation at /tmp/vhr_deser_poc_ok on your mailserver host. Inspect RabbitMQ Management at 127.0.0.1:15672 for suspicious activity like unexpected queue consumers or payloads. Look for base64-encoded Java serialized objects in queue messages.

Commands: curl -X POST http://127.0.0.1:15672/api/exchanges/%2f/amq.default/publish -u guest:guest -H 'Content-Type: application/json' -d '{"properties":{},"routing_key":"test","payload":"<base64-encoded-java-object>","payload_encoding":"base64"}'

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the mailserver consuming the RabbitMQ queue. This could lead to unauthorized access, data theft, or further compromise of the affected system. The impact depends on the privileges of the mailserver process.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using the vulnerable software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Disable default RabbitMQ credentials (guest:guest) and enforce strong authentication. Update RabbitMQ Management to the latest version. Monitor queues for unexpected payloads and restrict access to the RabbitMQ API endpoint.

Block external access to RabbitMQ Management (127.0.0.1:15672) if not required. Review and sanitize incoming messages to prevent deserialization attacks. Apply vendor patches if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart