Critical severity · published Oct 18, 2026
CVE-2026-111998
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
vanus · vanus-labs
0.8.0 through 0.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111998
github.com
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500
github.com
https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
github.com
https://github.com/vanus-labs/vanus/issues/647
www.vulncheck.com
https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
More from vanus
7.6
CVE-2026-112000
Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
7.5
CVE-2026-111999
Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver