CVE-2026-111998

9.8Critical

Published 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-1392

Impact

Unauthenticated remote attackers can take full cluster-admin control of Vanus to read or publish events and manage namespaces and users. They only need network access to send requests with the hardcoded Bearer token to the gateway gRPC proxy port.

Root cause

The tenant controller uses a hardcoded default admin token that grants full cluster administrative privileges.

Affected systems

Vanus 0.8.0 through 0.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Fixed version is not listed in the advisory. Block untrusted network access to the gateway gRPC proxy port or invalidate and rotate the default admin token.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111998