Vulnerability · Published Oct 18, 2026 · Assigned by VulnCheck
CVE-2026-111998Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
Critical 9.8
In plain English
A critical-severity security flaw in vanus from vanus-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| vanus-labs | vanus | 0.8.0 – through 0.9.0 |
Weakness: CWE-1392 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/vanus-labs/vanus/issues/647 issue-tracking
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500 technical-description
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37 technical-description
- VulnCheck Advisory: Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway third-party-advisory