by Kastro
Paper/Archive/CVE-2026-111998

CVE-2026-111998

vanus-labs vanus — Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

Affected

ProductAffectedFixed inSource
vanus0.8.0 – 0.9.0–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/vanus-labs/vanus/issues/647writeupgithub.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500writeupgithub.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37writeupvulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway