{"id":"CVE-2026-111998","published":"2026-10-18T12:17:11.730","lastModified":"2026-10-18T12:17:11.730","description":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1392"],"vendors":[],"products":[],"references":[{"url":"https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500","tags":[]},{"url":"https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37","tags":[]},{"url":"https://github.com/vanus-labs/vanus/issues/647","tags":[]},{"url":"https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway","tags":[]}],"exploitRefs":[{"url":"https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500","tags":[]},{"url":"https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37","tags":[]},{"url":"https://github.com/vanus-labs/vanus/issues/647","tags":[]}],"hasPoc":true,"ai":{"summary":"Vanus contains a default credentials vulnerability in versions 0.8.0 through 0.9.0 that allows unauthenticated attackers to gain full cluster-admin access using a hardcoded admin token, enabling complete control over namespaces, eventbuses, users, and events.","exploitability":"Very easy to exploit with no prerequisites; attackers simply need to send the fixed Bearer token to the gateway gRPC proxy port to gain full administrative privileges.","blast_radius":"Widespread impact across all affected Vanus installations that expose the gRPC proxy port, potentially allowing complete compromise of event-driven infrastructure and data access.","remediation":"Upgrade to Vanus 0.9.1 or later to resolve the hardcoded admin token vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","default-credentials","grpc"],"model":"garnet-coder","analyzedAt":"2026-10-18T15:46:52.894Z"}}