CVE-2026-111998: Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19
Weakness: CWE-1392

Description

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

Affected products

vanus-labs vanus: from 0.8.0 through 0.9.0

References

https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
https://github.com/vanus-labs/vanus/issues/647
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
https://github.com/vanus-labs/vanus/issues/647

Get alerted when CVE-2026-111998 or the next vulnerability affects your stack