AIKIDO-2026-259748
WolverineFx is vulnerable to Authorization Bypass
59
Medium Risk
This Affects:
WolverineFxTL;DR
Wolverine's EnvelopeSerializer writes every Envelope.Headers entry verbatim to the durable wire format after the typed envelope properties, with no reserved-key filter. Because the reader promotes reserved keys such as tenant-id, saga-id, and id straight back into the authoritative typed properties, a header entry under a reserved key silently overwrites the real property after a durable hop through the inbox, outbox, or scheduled-message store. An untrusted producer whose headers reach Envelope.Headers (for example via MassTransit interop or a custom envelope mapper copying raw broker headers) can spoof tenant, saga, and envelope identity, crossing tenant isolation and deduplication boundaries. The fix filters reserved keys on the write side so the typed property stays authoritative.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and reserved header keys from an untrusted source can reach Envelope.Headers over a durable transport, for example via MassTransit interop or a custom envelope mapper.
Background info
WolverineFx is vulnerable to Authorization Bypass in versions 0.8.2 - 6.17.3.
How to fix this
Upgrade the WolverineFx library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant