CVE-2026-111998
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 18, 2026
- Updated
- Oct 19, 2026
- Reserved
- Oct 18, 2026
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1392 Use of Default Credentials
Affected Products
| Product | Versions |
|---|---|
vanusvanus-labs |
|
References
- https://github.com/vanus-labs/vanus/issues/647issue-tracking
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500technical-description
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37technical-description
- VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gatewaythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.