CRITICAL 9.3 NVD
CVE-2026-111998
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the ha
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
References
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
- https://github.com/vanus-labs/vanus/issues/647
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-v
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-18 via NVD.
Risk Timeline
CVE Disclosed2026-10-18 · -1 days ago
Remediation Resources
vulnfeed aggregates 16809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.