CVE-2026-111998

EUVD-2026-103451
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.13%
Common Weakness Enumeration
References
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
https://github.com/vanus-labs/vanus/issues/647
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
https://github.com/vanus-labs/vanus/issues/647