CVE-2026-111998: vanus-labs vanus Use of Default Credentials
CVSS: 9.8v3.1CriticalReceived
Published 18-10-2026Last modified 18-10-2026
Vulnerability summary
CVE-2026-111998 is a critical (CVSS 9.8) Use of Default Credentials vulnerability in vanus-labs vanus.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 18-10-2026PublishedVulnerability first disclosed.
Description
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
CVSS metrics
4 scores · 2 sources · 2 versionsCritical 9.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Vanus-labs1 product
- vanus≥ 0.8.0, ≤ 0.9.0
1 vendor · 1 product
References
4 links- github.com/vanus-labs/vanus/issues/647Issue Tracking
- github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.goTechnical Description
- github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.goTechnical Description