Vanus: Default credentials allow cluster-admin access via gateway
Summary
Vanus versions 0.8.0 through 0.9.0 contain a hardcoded admin token. An unauthenticated remote attacker who sends this fixed Bearer token to the gateway gRPC proxy port can gain cluster-admin rights. The attacker could then manage namespaces, eventbuses, users, tokens and role bindings, and read or publish events. The CVSS 4.0 score is 9.3 (critical).
Affected
- Vanus 0.8.0 through 0.9.0 (vanus-labs/vanus)
- Default configuration is unaffected according to the CNA record
- Git ranges per OSV: introduced at d35053c, last affected at d76dc3af
Fixed in
Unknown. No confirmed fixed version was found at the time of research.
Workaround
- Restrict network access to the gateway gRPC port; keep it inside the cluster or behind a VPN
- Replace the hardcoded admin token where the product allows it
- Treat any exposed token as compromised and rotate it
- Audit use of the admin token and any new namespaces, users, tokens or role bindings you did not create
Exploitation
- No authentication required per the CVSS vector; the attack needs network access to the gateway port
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total
- Known exploited (KEV): not confirmed
- In-the-wild activity: nothing known
Our recommendation
- Check whether any Vanus gateway is reachable from untrusted networks, including the internet
- Block access to the gateway gRPC port from untrusted segments immediately
- Replace the hardcoded admin token and review logs for misuse
- Monitor for the vendor's fix (issue #647 and releases) and do not assume later versions are safe until confirmed
- Review related CVE-2026-111999 and CVE-2026-112000 in the same product
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: vanus controller.go (v0.9.0) github.com
- CVE record reference: vanus constants.go (v0.9.0) github.com
- Vanus issue #647 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-111998 osv.dev
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:21.
Original description (NVD)
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
NVD references (5)
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500
- https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37
- https://github.com/vanus-labs/vanus/issues/647
- https://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-default-admin-credentials-via-gateway
- https://github.com/vanus-labs/vanus/issues/647
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.