Vanus 0.8.0 to 0.9.0 Vulnerable to Critical Default Credential Attack
A critical flaw in Vanus versions 0.8.0 through 0.9.0 allows attackers to use a hardcoded token to gain full cluster-admin access without authentication.
Key points
- CVE-2026-111998 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- The vulnerability affects Vanus versions 0.8.0 through 0.9.0 from vanus-labs.
- Attackers can manage namespaces, users, and events using a fixed Bearer token.
The National Vulnerability Database has published CVE-2026-111998, identifying a critical security flaw in Vanus versions 0.8.0 through 0.9.0. This vulnerability allows unauthenticated remote attackers to gain cluster-admin access by exploiting hardcoded default credentials within the software, according to the NVD record.
At a glance
- CVE
- CVE-2026-111998
- Product
- vanus-labs vanus
- CVSS
- 9.3 Critical
- Weakness
- CWE-1392
- Exploited
- No known exploitation
The issue stems from a fixed Bearer token that attackers can send to the gateway gRPC proxy port. This weakness is classified under CWE-1392, which relates to default credentials. The NVD assigns the flaw a CVSS score of 9.3, categorizing it as Critical. No patch has been confirmed yet for this specific version range.
Context and Background
As Threat Times reported on 2026-10-18, hackers have increasingly used AI-assisted scripts to compromise Linux servers and steal admin credentials. While that incident involved spoofed prompts and PHP modifications, the current Vanus flaw is distinct because it relies on hardcoded tokens rather than social engineering or runtime manipulation.
The Vanus vulnerability allows attackers to manage namespaces, eventbuses, users, tokens, and role bindings. They can also read or publish events within the system. This level of access is significant because it grants control over core infrastructure components without requiring any prior authentication or user interaction.
Who Is Affected
The vulnerability affects Vanus software produced by vanus-labs. Specifically, versions 0.8.0 through 0.9.0 are impacted. Any deployment using these versions is potentially exposed to unauthorized access if the gateway gRPC proxy port is reachable from the network. Organizations running these versions should verify their exposure immediately.
The hardcoded admin token serves as a universal key for cluster-admin privileges. This means that any remote attacker who can reach the service can assume full administrative control. The NVD record does not list any mitigations other than avoiding the affected versions, as no fix has been confirmed yet.
What should you do?
Security teams should audit their environments for any installations of Vanus versions 0.8.0 through 0.9.0. If these versions are present, organizations should consider isolating the systems from untrusted networks until a vendor update is available. Monitoring logs for unauthorized access attempts on the gRPC proxy port is also advisable.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Vanus
- Inventory all systems to identify installations of Vanus versions 0.8.0 through 0.9.0.
- Restrict network access to the gateway gRPC proxy port to prevent unauthenticated remote connections.
- Monitor system logs for suspicious administrative actions or token usage patterns that indicate exploitation.
- Wait for the vendor to release an official update or patch before applying any unofficial workarounds.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111998?
The CVSS score is 9.3, which is rated as Critical by the National Vulnerability Database.
Which versions of Vanus are affected by this vulnerability?
Vanus versions 0.8.0 through 0.9.0 from vanus-labs are affected by this default credential issue.
Can attackers exploit this flaw remotely?
Yes, unauthenticated remote attackers can exploit this by sending a fixed Bearer token to the gateway gRPC proxy port.
