CVE-2026-111998 Details
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
A default credentials vulnerability has been identified in Vanus versions 0.8.0 through 0.9.0. This vulnerability allows unauthenticated remote attackers to gain cluster-admin access by exploiting a hardcoded admin token. Attackers can send this token to the gateway gRPC proxy port to manage various resources such as namespaces, event buses, users, tokens, and role bindings, as well as read or publish events.
No official fix is available, but it is recommended to manually change the default admin token or implement a random token generation mechanism at the first startup.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vanus-labs/vanus/issues/647 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500 | [email protected] | Source CodeVendor |
| https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37 | [email protected] | Source CodeVendor |
| https://github.com/vanus-labs/vanus/issues/647 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1392 | Use of Default Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vanus | >= 0.8.0, <= 0.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |