CVE-2026-111998

Summary

Vanus contains a default credentials vulnerability in versions 0.8.0 through 0.9.0 that allows unauthenticated attackers to gain full cluster-admin access using a hardcoded admin token, enabling complete control over namespaces, eventbuses, users, and events.

Exploitability

Very easy to exploit with no prerequisites; attackers simply need to send the fixed Bearer token to the gateway gRPC proxy port to gain full administrative privileges.

Blast radius

Widespread impact across all affected Vanus installations that expose the gRPC proxy port, potentially allowing complete compromise of event-driven infrastructure and data access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Vanus 0.9.1 or later to resolve the hardcoded admin token vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.