Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-111998: Vanus 0.8‑0.9 allows remote admin access via default token
CVE-2026-111998 · published today
Summary
Versions 0.8.0 through 0.9.0 of Vanus come with a built-in administrator token that is the same for every installation. Anyone who knows this token can connect to the system's gateway and act as a cluster administrator, creating or deleting data and viewing or sending events. Update to a newer version or replace the default token with a unique, strong secret as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vanus-labs | vanus | <= 0.9.0 |
Original advisory text
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
References
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/contr... technical-description
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#... technical-description
- https://github.com/vanus-labs/vanus/issues/647 issue-tracking
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-cre... third-party-advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-1392Use of Default Credentials
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Track software like this
Free during beta