CVE-2026-111998

critical · 9.3

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

9.3

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-10-18

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-1392

References

https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
https://github.com/vanus-labs/vanus/issues/647
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
https://github.com/vanus-labs/vanus/issues/647

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-111998