CVEvulnerability
CVE-2026-111998
9.3 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-10-18
- Last modified
- 2026-10-19
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1392
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
Related
Weakness · CWE (1)
- CWE-1392 Use of Default Credentials weakness
References
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500 github.com
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37 github.com
- https://github.com/vanus-labs/vanus/issues/647 github.com
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway www.vulncheck.com
- https://github.com/vanus-labs/vanus/issues/647 github.com