Default Credentials Vulnerability in Vanus by Vanus Labs

CVE-2026-111998

What is CVE-2026-111998?

The Vanus versions 0.8.0 and 0.9.0 are impacted by a default credentials vulnerability, allowing unauthorized remote attackers to achieve cluster-admin access. By leveraging a hardcoded admin token, attackers can send this fixed Bearer token to the gateway gRPC proxy port. This enables them to manage critical components such as namespaces, eventbuses, users, tokens, and role bindings, alongside the ability to read or publish events. This presents a significant security risk for users of the affected versions.

References