CVE-2026-111998criticalCWE-1392

CVE-2026-111998: critical vulnerability in vanus-labs vanus

Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway

Published · Updated

Follow this CVE+ Monitor vanus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.7%
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
vanus-labs · vanus
Related CVEs — vanus-labs vanus

In the same product, most dangerous first.

CVE-2026-111999HIGHVanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP ReceiverEPSS 0.5%CVE-2026-112000HIGHVanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCsEPSS 0.3%