CVE-2026-111998: Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running Vanus versions 0.8.0 through 0.9.0 are exposed if an attacker can reach the gateway gRPC proxy port. No prior authentication or user interaction is required.
What access does successful exploitation provide?
An attacker using the hardcoded Bearer token can obtain cluster-admin access. They can manage namespaces, eventbuses, users, tokens, and role bindings, and can read or publish events.
How can defenders determine whether they are affected?
Verify whether the deployment is running Vanus 0.8.0 through 0.9.0 and whether its gateway gRPC proxy port is reachable by untrusted networks. A reachable affected gateway should be treated as susceptible because the admin token is hardcoded.